{"id":"CVE-2019-1663","published":"2019-02-28T18:00:00Z","modified":"2024-11-19T19:16:07Z","title":"Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability","vendor":"Cisco","product":"RV110W Wireless-N VPN Firewall","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"RV110W Wireless-N VPN Firewall","versions":[">= unspecified, < 1.2.2.1"]},{"vendor":"Cisco","product":"RV130W Wireless-N Multifunction VPN Router","versions":[">= unspecified, < 1.0.3.45"]},{"vendor":"Cisco","product":"RV215W Wireless-N VPN Router","versions":[">= unspecified, < 1.3.1.1"]}],"description":{"text":"A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is improper validation of user-supplied data in the web-based management interface of the Cisco RV110W, RV130W, and RV215W Wireless-N VPN routers and firewalls. An unauthenticated remote attacker who sends malicious HTTP requests to the management interface can execute arbitrary code on the underlying operating system as a high-privilege user, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.95707,"percentile":0.99871,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2019-03-01","exploitedFirstSeen":"2019-03-01","ransomware":false,"evidence":[{"url":"https://twitter.com/bad_packets/status/1101591064362725376","date":"2019-03-01"},{"url":"https://www.zdnet.com/article/hackers-have-started-attacks-on-cisco-rv110-rv130-and-rv215-routers/","date":"2019-03-03"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex","date":"2019-03-27"},{"url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","date":"2025-10-09"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"RondoDox | Guest System attacking | EuroTarget","url":"https://otx.alienvault.com/pulse/696a8dc74871e9a34cab06a6","created":"2026-01-16"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68ef1f1c1147b89b19c4d033","created":"2025-10-15"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68edfcbbbd279218c489e1c6","created":"2025-10-14"},{"name":"RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits.","url":"https://otx.alienvault.com/pulse/68e8a86a47a46c13c5d69ab6","created":"2025-10-10"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68e86b551440846b11a598a1","created":"2025-10-10"},{"name":"UPX executable packer.","url":"https://otx.alienvault.com/pulse/663d2869e0f3a42bbddc42ff","created":"2024-05-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/107185","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/cisco_rv130_rmi_rce","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/152507/Cisco-RV130W-Routers-Management-Interface-Remote-Command-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46705/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://packetstormsecurity.com/files/153163/Cisco-RV130W-1.0.3.44-Remote-Stack-Overflow.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/154310/Cisco-RV110W-RV130-W-RV215W-Remote-Command-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-10220","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10220","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46705,"url":"https://www.exploit-db.com/exploits/46705","title":"Cisco RV130W Routers - Management Interface Remote Command Execution (Metasploit)","type":"remote","platform":"hardware","date":"2019-04-15","verified":true,"provenance":"source"},{"id":46705,"url":"https://www.exploit-db.com/exploits/46705","title":"Cisco RV130W Routers - Management Interface Remote Command Execution (Metasploit)","type":"remote","platform":"hardware","date":"2019-04-15","verified":true,"provenance":"source"},{"id":46961,"url":"https://www.exploit-db.com/exploits/46961","title":"Cisco RV130W 1.0.3.44 - Remote Stack Overflow","type":"remote","platform":"hardware","date":"2019-06-04","verified":false,"provenance":"source"},{"id":47348,"url":"https://www.exploit-db.com/exploits/47348","title":"Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)","type":"remote","platform":"hardware","date":"2019-09-03","verified":true,"provenance":"source"},{"id":47348,"url":"https://www.exploit-db.com/exploits/47348","title":"Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)","type":"remote","platform":"hardware","date":"2019-09-03","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":5,"earliest":"2019-04-15"},"pocGithub":{"count":1,"skipped":2,"earliest":"2023-10-25","earliestUrl":"https://github.com/StealYourCode/CVE-2019-1663","repos":[{"name":"StealYourCode/CVE-2019-1663","url":"https://github.com/StealYourCode/CVE-2019-1663","stars":0,"created":"2023-10-25"}]},"metasploit":[{"name":"Cisco RV110W/RV130(W)/RV215W Routers Management Interface Remote Command Execution","module":"exploit/linux/http/cve_2019_1663_cisco_rmi_rce","type":"exploit","disclosureDate":"2019-02-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cve_2019_1663_cisco_rmi_rce.rb"}],"first":{"date":"2019-02-27","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cve_2019_1663_cisco_rmi_rce.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46705/","http://packetstormsecurity.com/files/152507/Cisco-RV130W-Routers-Management-Interface-Remote-Command-Execution.html","http://packetstormsecurity.com/files/153163/Cisco-RV130W-1.0.3.44-Remote-Stack-Overflow.html","http://packetstormsecurity.com/files/154310/Cisco-RV110W-RV130-W-RV215W-Remote-Command-Execution.html"],"flow":[],"timeline":[{"date":"2019-02-27","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-04-15, PoC-in-GitHub 2023-10-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cve_2019_1663_cisco_rmi_rce.rb","provenance":"source"},{"date":"2019-02-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-1663","provenance":"source"},{"date":"2019-03-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://twitter.com/bad_packets/status/1101591064362725376","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":68.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2799 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 5 Exploit-DB entries; 3 NVD exploit links; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}