CVE-2019-15271VulnerabilityPublished 06/08/2022Updated 10/24/2026

CVE-2019-15271: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Affects Cisco RV Series RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 06/08/2022
KEV deadline: 06/22/2022
EPSS: 5.5% chance of exploitation in 30 days – higher than 92% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-15271 (opens in a new tab)

Description

CVE-2019-15271 is a deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers. This flaw could allow an attacker to execute code with root privileges on affected devices. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Summary

This vulnerability involves improper deserialization of untrusted data in the web management interface of Cisco RV Series Routers. Exploiting this flaw enables an attacker to execute arbitrary code with root-level privileges, potentially compromising the device fully. The vulnerability is tracked as CVE-2019-15271 and has been observed in active exploitation campaigns. The input data does not specify which exact versions are affected or if a patch is available.

Impact

Successful exploitation allows remote code execution with root privileges on affected Cisco RV Series Routers, leading to full device compromise. This can result in unauthorized control over the router, potentially impacting network security and availability. The vulnerability is known to be exploited in the wild, increasing the urgency of mitigation.

Mitigation

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict access to the router's web management interface to trusted networks and users only. Monitor Cisco's security advisories for updates and apply patches promptly once available.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:04:43 UTC

Weaknesses

References

Related threats