CVE-2019-15271 Cisco RV Series Routers Deserialization of Untrusted Data
Authenticated attackers can execute arbitrary commands with root privileges on Cisco Small Business RV Series Routers via the web management interface.
- Exploited in the wild
- Since 8 Jun 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15271?
CVE-2019-15271 is a high-severity command injection vulnerability in Cisco Small Business RV Series Router Firmware, published on 26 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Weakness: CWE-502
Which versions are affected by CVE-2019-15271?
It affects 4 products.
Products include Cisco Rv016 Multi-Wan Vpn Firmware, Cisco Rv042 Dual Wan Vpn Firmware, Cisco Rv042g Dual Gigabit Wan Vpn Firmware, Cisco Rv082 Dual Wan Vpn Firmware.
How do I fix CVE-2019-15271?
No fix has been published for CVE-2019-15271 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 22 Jun 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-15271 being exploited?
Yes. Attackers have exploited CVE-2019-15271 in the wild since at least 8 Jun 2022.
Other vulnerabilities in Cisco Small Business RV Series Router Firmware
Sources
Also known as GHSA-87q2-rr35-r6c9.