Actively exploited in the wild
Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
Cisco - RV Series Routers · Listed in the CISA KEV since 2022-06-08. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-15271
HighCVSS 8.8KEVSummary
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload.
Risk Assessment
An authenticated attacker could take full control of the router by executing commands as root, potentially leading to further network attacks.
Recommendation
Update the Cisco Small Business RV Series Router software to the latest version and restrict access to the management interface.
Other vulnerabilities in Cisco Small Business RV Series Routers
See all- CVE-2022-20708CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20703CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20701CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20700CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
- CVE-2022-20699CriticalActively exploited
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Original NVD description (English source)
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.