CVE-2019-15271
HighExploitedPublic exploitA vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges.
Published Nov 26, 2019 · Updated Oct 28, 2025
Key Facts
Patch immediately- CVE-2019-15271 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Rv016 Multi-Wan VPN Firmware (Cisco), Rv042 Dual Wan VPN Firmware (Cisco), Rv042g Dual Gigabit Wan VPN Firmware (Cisco) and 2 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 7, 2022. Public exploit code is available.
- EPSS estimates a 5.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including Rv016 Multi-Wan VPN Firmware 4.2.3.10, Rv042 Dual Wan VPN Firmware 4.2.3.10, Rv042g Dual Gigabit Wan VPN Firmware 4.2.3.10.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
5.5%
Higher than 92.6% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-15271 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| Industry KEV feed | Jun 7, 2022 | Jun 22, 2022 | Not reported |
| CIRCL KEV | Jun 8, 2022 | Jun 22, 2022 | Not reported |
| ENISA EUVD | Jun 8, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
5 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Rv016 Multi-Wan VPN FirmwareCisco | See advisory | 4.2.3.10 |
| Rv042 Dual Wan VPN FirmwareCisco | See advisory | 4.2.3.10 |
| Rv042g Dual Gigabit Wan VPN FirmwareCisco | See advisory | 4.2.3.10 |
| Rv082 Dual Wan VPN FirmwareCisco | See advisory | 4.2.3.10 |
| Cisco Small Business RV Series Router Firmware | >= unspecified | n/a |
Patched Releases
Rv016 Multi-Wan VPN Firmware
4.2.3.10
Rv042 Dual Wan VPN Firmware
4.2.3.10
Rv042g Dual Gigabit Wan VPN Firmware
4.2.3.10
Rv082 Dual Wan VPN Firmware
4.2.3.10
Cisco Small Business RV Series Router Firmware
n/a
Timeline
Publicly disclosed
Nov 26, 2019
Added to Industry KEV feed
Jun 7, 2022
Added to CISA KEV
Jun 8, 2022
Added to CIRCL KEV
Jun 8, 2022
Added to ENISA EUVD
Jun 8, 2022
Last updated
Oct 28, 2025
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisory20191106 Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- otherhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15271
FAQ
Common Questions.
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges.
Affected: Rv016 Multi-Wan VPN Firmware (Cisco); Rv042 Dual Wan VPN Firmware (Cisco); Rv042g Dual Gigabit Wan VPN Firmware (Cisco), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 7, 2022.
Yes. It was added on Jun 8, 2022 with a federal remediation due date of Jun 22, 2022.
Public exploit code is available.
Fixed versions are available, including Rv016 Multi-Wan VPN Firmware 4.2.3.10, Rv042 Dual Wan VPN Firmware 4.2.3.10, Rv042g Dual Gigabit Wan VPN Firmware 4.2.3.10.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-15271 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo