CVE-2019-15271: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Vulnerability summary

CVE-2019-15271 is a high (CVSS 9.0) Deserialization of Untrusted Data vulnerability in Cisco RV Series Routers. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 5.49% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities.

Timeline

1. 26-11-2019
   PublishedVulnerability first disclosed.
2. 08-06-2022
   Added to CISA KEVCisco RV Series Routers Deserialization of Untrusted Data Vulnerability
3. 22-06-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.