CVE-2019-15271

published 2019-11-26

CVE-2019-15271: A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to…

Priority P1 86 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

KEV ITW

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_rv_series_router_firmware	>= unspecified < n/a	n/a
cisco	rv016_multi-wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv042_dual_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv042g_dual_gigabit_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv082_dual_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	small_business_rv016_rv042_rv042g_and_rv082_routers	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Exploit vector targets the web-based management interface via a malicious HTTP request with unsanitized payload — monitor for anomalous or unexpected HTTP POST/GET requests to the RV series router management interface, particularly those containing serialized data or shell metacharacters in parameters. ↗
• → Root-level command execution is the outcome of successful exploitation — alert on unexpected processes spawned by the web server process (e.g., httpd) on Cisco RV016, RV042, RV042G, and RV082 devices. ↗
• → The vulnerability is rooted in deserialization of untrusted data (CWE-502) — inspect HTTP payloads directed at the management interface for serialized Java/PHP objects or other deserialization gadget chains. ↗
• → Authentication bypass is not required but a valid session token is sufficient — monitor for session token reuse or credential stuffing attempts against the management interface prior to exploitation. ↗
• → Cisco Bug IDs CSCvq95596, CSCvq97028, and CSCvq97031 are associated with this CVE — use these identifiers when querying Cisco TAC logs or PSIRT feeds for affected firmware versions. ↗

• · Exploitation requires authentication (valid credential or active session token) — this is an authenticated RCE, not unauthenticated. Detection rules should account for the pre-authentication step. ↗
• · Affected devices are specifically Cisco Small Business RV016, RV042, RV042G, and RV082 routers — scope detection and patching efforts to these models only. ↗
• · No workarounds exist for this vulnerability — the only remediation is applying vendor-supplied software updates. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

vulncheck 8.8 HIGH

cisa 8.8 HIGH

vendor_cisco 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502