--- id: "CVE-2019-15271" kind: "vulnerability" aliases: ["CVE-2019-15271"] title: "A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow\u2026" severity: "critical" cvss: 9.0 epss: 0.05488 exploited: true status: "open" category: "infrastructure" products: [{"name": "Cisco RV Series Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Cisco RV042 / RV042G Routers", "fixed": ["4.2.3.10"], "affected": "< 4.2.3.10", "ecosystem": "vendor"}, {"name": "Cisco RV016 / RV082 Routers", "fixed": [], "affected": "< 4.2.3.10 (end of software maintenance)", "ecosystem": "vendor"}, {"name": "cisco rv016 multi-wan vpn firmware", "fixed": ["4.2.3.10"], "affected": "< 4.2.3.10", "ecosystem": "vendor"}, {"name": "cisco rv042 dual wan vpn firmware", "fixed": ["4.2.3.10"], "affected": "< 4.2.3.10", "ecosystem": "vendor"}, {"name": "cisco rv042g dual gigabit wan vpn firmware", "fixed": ["4.2.3.10"], "affected": "< 4.2.3.10", "ecosystem": "vendor"}, {"name": "cisco rv082 dual wan vpn firmware", "fixed": ["4.2.3.10"], "affected": "< 4.2.3.10", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cisco", "end-of-life", "exploited", "infrastructure", "routers", "rv-series", "rv042", "rv082", "small-business"] not_affected_if: ["firmware-4.2.3.10-or-later", "no-rv-series-router", "remote-management-disabled-reduces-exposure", "rv320-rv325", "web-management-disabled"] published_at: "2019-11-26T03:15:11+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-15271", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-15271", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:13:47+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15271", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow… Deserialization / missing input validation in the web management interface of Cisco RV016, RV042, RV042G and RV082 routers lets an authenticated remote attacker run commands as root. Cisco saw attempted exploitation in the wild in June 2022 and CISA lists it as exploited. Cisco's rating is High (CVSS 8.8), because the attacker needs a valid login or session token. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco RV Series Routers affected ? fixed ? - vendor:Cisco RV042 / RV042G Routers affected < 4.2.3.10 fixed 4.2.3.10 - vendor:Cisco RV016 / RV082 Routers affected < 4.2.3.10 (end of software maintenance) fixed ? - vendor:cisco rv016 multi-wan vpn firmware affected < 4.2.3.10 fixed 4.2.3.10 - vendor:cisco rv042 dual wan vpn firmware affected < 4.2.3.10 fixed 4.2.3.10 - vendor:cisco rv042g dual gigabit wan vpn firmware affected < 4.2.3.10 fixed 4.2.3.10 - vendor:cisco rv082 dual wan vpn firmware affected < 4.2.3.10 fixed 4.2.3.10 ## How to check Log in to the router web UI and read the firmware version (System Summary). Vulnerable if the model is RV016, RV042, RV042G or RV082 and firmware is earlier than 4.2.3.10. Then check Firewall > General: if Remote Management is ticked, the web UI is reachable from the WAN (default is off). ## Fix RV042 and RV042G: upgrade to firmware 4.2.3.10 or later from Cisco Software Center (no service contract needed; contact Cisco TAC with serial number and the advisory URL). RV016 and RV082 are end of software maintenance and Cisco lists no fixed release for them, so replace them. No workaround, but untick Firewall > General > Remote Management to remove WAN exposure, and use strong admin credentials. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-15271 - 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-15271 - 2026-10-23T21:13:47+00:00 analyst — Cisco advisory cisco-sa-20191106-sbrv-cmd-x: RV016/RV042/RV042G/RV082 below 4.2.3.10; Cisco itself rates it High (CVSS 8.8), needs valid credentials or session token; exploitation attempts seen June 2022 and in CISA KEV. No public PoC link found. - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-15271 ## Documents - [advisory] Cisco advisory cisco-sa-20191106-sbrv-cmd-x https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x - [mentions] CISA KEV: CVE-2019-15271 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f=vendor_project%3A1000&f=vendor_project%3A1174&f=vendor_project%3A1249&f=vendor_project%3A1273&page=4 ## From the sources A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_