CVE-2019-1663
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.
Public exploit
A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system.
- 46705 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
Timeline
ID reserved
By cisco
- 3 months later
· 3 months later
Published
- 6 years later
· 6 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 95.7% · top 0.1% of all CVEs (8 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
Cisco · RV110W Wireless-N VPN Firewall
- affected unspecified – < 1.2.2.1
Cisco · RV130W Wireless-N Multifunction VPN Router
- affected unspecified – < 1.0.3.45
Cisco · RV215W Wireless-N VPN Router
- affected unspecified – < 1.3.1.1
What to do
Exploitation: Security researchers announced the discovery of this vulnerability, without any technical details or mention of the affected products, at the GeekPwn Shanghai conference on October 24-25, 2018.
References (7)
- 107185 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20190227 Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
- http://www.rapid7.com/db/modules/exploit/linux/http/cisco_rv130_rmi_rce (opens in a new tab)x_refsource_MISCx_transferred
- http://packetstormsecurity.com/files/152507/Cisco-RV130W-Routers-Management-Interface-Remote-Command-Execution.html (opens in a new tab)x_refsource_MISCx_transferred
- 46705 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
- http://packetstormsecurity.com/files/153163/Cisco-RV130W-1.0.3.44-Remote-Stack-Overflow.html (opens in a new tab)x_refsource_MISCx_transferred
- http://packetstormsecurity.com/files/154310/Cisco-RV110W-RV130-W-RV215W-Remote-Command-Execution.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2019-1663)Record last updated .