Cisco · Cisco Small Business Rv082 · CVE-2019-15271
**Name of the Vulnerable Software and Affected Versions**
Cisco RV Series Routers (affected versions not specified)
Cisco Small Business RV016 (affected versions not specified)
Cisco Small Business RV042 (affected versions not specified)
Cisco Small Business RV042G (affected versions not specified)
Cisco Small Business RV082 (affected versions not specified)
**Description**
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload, specifically deserialization of untrusted data. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
**Recommendations**
For Cisco RV Series Routers, consider restricting access to the web-based management interface until a patch is available.
For Cisco Small Business RV016, RV042, RV042G, and RV082, restrict access to the web-based management interface to minimize the risk of exploitation.
As a temporary workaround, consider disabling remote management capabilities until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.