{"id":"CVE-2019-15271","kind":"vulnerability","aliases":["CVE-2019-15271"],"related":[],"title":"A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow…","description":"A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.","summary":"Deserialization / missing input validation in the web management interface of Cisco RV016, RV042, RV042G and RV082 routers lets an authenticated remote attacker run commands as root. Cisco saw attempted exploitation in the wild in June 2022 and CISA lists it as exploited. Cisco's rating is High (CVSS 8.8), because the attacker needs a valid login or session token.","severity":"critical","cvss":9.0,"epss":0.05488,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Cisco RV Series Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco RV042 / RV042G Routers","fixed":["4.2.3.10"],"affected":"< 4.2.3.10","ecosystem":"vendor"},{"name":"Cisco RV016 / RV082 Routers","fixed":[],"affected":"< 4.2.3.10 (end of software maintenance)","ecosystem":"vendor"},{"name":"cisco rv016 multi-wan vpn firmware","fixed":["4.2.3.10"],"affected":"< 4.2.3.10","ecosystem":"vendor"},{"name":"cisco rv042 dual wan vpn firmware","fixed":["4.2.3.10"],"affected":"< 4.2.3.10","ecosystem":"vendor"},{"name":"cisco rv042g dual gigabit wan vpn firmware","fixed":["4.2.3.10"],"affected":"< 4.2.3.10","ecosystem":"vendor"},{"name":"cisco rv082 dual wan vpn firmware","fixed":["4.2.3.10"],"affected":"< 4.2.3.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","end-of-life","exploited","infrastructure","routers","rv-series","rv042","rv082","small-business"],"not_affected_if":["firmware-4.2.3.10-or-later","no-rv-series-router","remote-management-disabled-reduces-exposure","rv320-rv325","web-management-disabled"],"how_to_check":"Log in to the router web UI and read the firmware version (System Summary). Vulnerable if the model is RV016, RV042, RV042G or RV082 and firmware is earlier than 4.2.3.10. Then check Firewall > General: if Remote Management is ticked, the web UI is reachable from the WAN (default is off).","fix":"RV042 and RV042G: upgrade to firmware 4.2.3.10 or later from Cisco Software Center (no service contract needed; contact Cisco TAC with serial number and the advisory URL). RV016 and RV082 are end of software maintenance and Cisco lists no fixed release for them, so replace them. No workaround, but untick Firewall > General > Remote Management to remove WAN exposure, and use strong admin credentials.","status":"open","published_at":"2019-11-26T03:15:11+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:57+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T21:12:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco firmware update for your RV Series model per vendor instructions, as CISA requires. Exact fixed versions: unknown","reach":"unknown","impact":"high","summary":"Certain Cisco Small Business RV Series routers have a deserialization flaw in their web-based management interface. An attacker who reaches that interface can execute code as root on the router.","category":"infrastructure","who_cares":["cisco","rv-series","routers","small-business"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code as root on the router, taking over the device","analyst_note":"Find affected RV model list, fixed firmware versions and whether web management must be exposed to WAN, via Cisco advisory for CVE-2019-15271 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-rv-series-router","web-management-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2851,"output_tokens":361,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected RV model list, fixed firmware versions and whether web management must be exposed to WAN, via Cisco advisory for CVE-2019-15271 and the CISA KEV entry.","search":"'-15271':22A,25A '-2019':21A,24A '2022':115B '8.8':128B 'activ':179C 'allow':19A,157C,222C 'arbitrari':164C 'attack':101B,131B,161C,170C,196C,224C 'attempt':108B 'authent':99B,159C 'base':7A,145C,211C 'busi':14A,79B,152C 'certain':11A,149C 'cisa':117B 'cisco':12A,26A,30A,34A,38A,45A,51A,58A,64B,90B,106B,122B,150C 'command':103B,165C,227C 'could':18A,156C,197C,221C 'credenti':176C 'cve':20A,23A 'cvss':127B 'deseri':80B 'devic':217C 'dual':47A,53A,60A 'due':185C 'either':173C 'end':66B 'end-of-lif':65B 'execut':163C,226C 'exploit':69B,109B,121B,198C,220C 'firmware':44A,50A,57A,63A 'gigabit':54A 'high':126B 'http':193C,205C 'infrastructur':70B 'input':82B,189C 'interfac':9A,88B,147C,213C 'june':114B 'lack':187C 'let':97B 'life':68B 'list':118B 'login':135B 'malici':204C 'manag':8A,87B,146C,212C 'miss':81B 'multi':41A 'multi-wan':40A 'must':171C 'need':132B 'payload':194C 'privileg':168C,230C 'rate':124B 'remot':100B,160C 'request':206C 'root':105B,167C,229C 'router':17A,71B,96B,155C 'routers':29A,33A,37A 'run':102B 'rv':15A,27A,73B,153C 'rv-seri':72B 'rv016':35A,39A,91B 'rv042':31A,46A,75B,92B 'rv042g':32A,52A,93B 'rv082':36A,59A,76B,95B 'saw':107B 'send':202C 'seri':16A,74B,154C 'series':28A 'session':137B,180C 'small':13A,78B,151C 'small-busi':77B 'success':219C 'target':216C 'token':138B,181C 'valid':83B,134B,175C,190C 'vpn':43A,49A,56A,62A 'vulner':2A,140C,183C,200C 'wan':42A,48A,55A,61A 'web':6A,86B,144C,210C 'web-bas':5A,143C,209C 'wild':112B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-11-26T03:15:11+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-15271","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-15271","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"epss","external_id":"CVE-2019-15271","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-15271","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-15271:44","url":null,"severity":null,"published_at":"2026-10-23T21:13:47+00:00","modified_at":"2026-10-23T21:13:47+00:00","first_seen_at":"2026-10-23T21:13:47+00:00","fetched_at":"2026-10-23T21:13:47+00:00","note":"Cisco advisory cisco-sa-20191106-sbrv-cmd-x: RV016/RV042/RV042G/RV082 below 4.2.3.10; Cisco itself rates it High (CVSS 8.8), needs valid credentials or session token; exploitation attempts seen June 2022 and in CISA KEV. No public PoC link found."},{"source":"nvd","external_id":"CVE-2019-15271","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15271","severity":null,"published_at":"2019-11-26T03:15:11+00:00","modified_at":"2026-06-17T02:19:59+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":917,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x","title":"Cisco advisory cisco-sa-20191106-sbrv-cmd-x","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":918,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f=vendor_project%3A1000&f=vendor_project%3A1174&f=vendor_project%3A1249&f=vendor_project%3A1273&page=4","title":"CISA KEV: CVE-2019-15271","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}