CVE-2019-15271: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Other sources
A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the web-based management interface is not required, disable it. Otherwise restrict the management interface to the LAN or to a dedicated management network and/or to specific trusted IP addresses on the device itself.
Cisco Small Business RV Series Routers web-based management interface = disabled or restricted to trusted hosts - Compensating control
Restrict access to the router management interface at the network perimeter (firewall/ACL) so that only trusted management IPs/networks can reach the device; block access from the public Internet.
- Operational
Rotate all administrative credentials and invalidate existing session tokens (force logout of active sessions) to remove any attacker access that relies on valid credentials or active session tokens.
Event History
Frequently Asked Questions
What is CVE-2019-15271?
CVE-2019-15271 is a vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers.
How does CVE-2019-15271 impact Cisco RV Series Routers?
CVE-2019-15271 allows an authenticated, remote attacker to execute arbitrary commands with root privileges on affected Cisco RV Series Routers.
Who can exploit CVE-2019-15271?
An attacker with either a valid credential or an active session token can exploit CVE-2019-15271.
What is the severity of CVE-2019-15271?
CVE-2019-15271 has a severity rating of 8.8 (Critical).
How can I fix the vulnerability CVE-2019-15271?
To fix CVE-2019-15271, users should follow the guidelines provided by Cisco in their security advisory.