Live › vulnerability › CVE-2019-15271
Go to dashboardDeserialization / missing input validation in the web management interface of Cisco RV016, RV042, RV042G and RV082 routers lets an authenticated remote attacker run commands as root. Cisco saw attempted exploitation in the wild in June 2022 and CISA lists it as exploited. Cisco's rating is High (CVSS 8.8), because the attacker needs a valid login or session token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco RV Series Routers | vendor | – | – |
| Cisco RV042 / RV042G Routers | vendor | < 4.2.3.10 | 4.2.3.10 |
| Cisco RV016 / RV082 Routers | vendor | < 4.2.3.10 (end of software maintenance) | – |
| cisco rv016 multi-wan vpn firmware | vendor | < 4.2.3.10 | 4.2.3.10 |
| cisco rv042 dual wan vpn firmware | vendor | < 4.2.3.10 | 4.2.3.10 |
| cisco rv042g dual gigabit wan vpn firmware | vendor | < 4.2.3.10 | 4.2.3.10 |
| cisco rv082 dual wan vpn firmware | vendor | < 4.2.3.10 | 4.2.3.10 |
4.2.3.104.2.3.10 or later from Cisco Software Center (no service contract needed; contact Cisco TAC with serial number and the advisory URL)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
This page as .md · .json · in your agent: get_signal("CVE-2019-15271")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.