CVE-2019-15271
| CVE Published | 2019-11-26 |
|---|---|
| Related CWE(s) | CWE-502: Deserialization of Untrusted Data |
| Related Vendor(s) | cisco |
| Related Product(s) | rv082_dual_wan_vpn_firmware, rv042_dual_wan_vpn_firmware, rv016_multi-wan_vpn_firmware, rv042g_dual_gigabit_wan_vpn_firmware |
| Exploitation Reported (CISA KEV) | 2022-06-08 |
| CVSS 3 Base Score | 8.8 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | NETWORK |
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph