{"id":"CVE-2019-15107","published":"2019-08-16T03:15:11Z","modified":"2026-08-06T05:16:35Z","title":"Webmin Command Injection Vulnerability","vendor":"Webmin","product":"Webmin","tier":"core","eol":null,"description":{"text":"An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a command injection vulnerability in Webmin, affecting versions up to and including 1.920, located in the old parameter of the password_change.cgi component. An attacker able to reach the Webmin interface over the network can send crafted input through that parameter to run operating system commands, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9971,"percentile":0.99952,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-15107","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-12-17","exploitedFirstSeen":"2019-12-17","ransomware":true,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada","date":"2019-12-17"},{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","date":"2020-12-01"},{"url":"https://cujo.com/the-sysrv-botnet-and-how-it-evolved/","date":"2021-09-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf","date":"2022-04-27"},{"url":"https://unit42.paloaltonetworks.com/mirai-variant-v3g4/","date":"2023-02-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2019-15107","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2019-15107","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2019-15107","date":"2023-11-21"}],"evidenceTotal":888,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.webmin.com/security.html","tags":["Vendor Advisory"]},{"url":"https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/47230","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.webmin.com/security.html","tags":["Vendor Advisory"]},{"url":"https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/47230","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15107","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Network-reachable web CGI endpoint, unauthenticated","mappingType":"uncategorized","evidence":[{"from":"description","quote":"The parameter old in password_change.cgi contains a command injection vulnerability","start":43,"end":126}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"The parameter old in password_change.cgi contains a command injection vulnerability","start":43,"end":126}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-6178","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6178","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":47230,"url":"https://www.exploit-db.com/exploits/47230","title":"Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-08-12","verified":true,"provenance":"source"},{"id":47293,"url":"https://www.exploit-db.com/exploits/47293","title":"Webmin 1.920 - Remote Code Execution","type":"webapps","platform":"linux","date":"2019-08-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-08-12"},"pocGithub":{"count":33,"skipped":9,"earliest":"2019-08-19","earliestUrl":"https://github.com/jas502n/CVE-2019-15107","repos":[{"name":"jas502n/CVE-2019-15107","url":"https://github.com/jas502n/CVE-2019-15107","stars":66,"created":"2019-08-19"},{"name":"MuirlandOracle/CVE-2019-15107","url":"https://github.com/MuirlandOracle/CVE-2019-15107","stars":56,"created":"2020-11-09"},{"name":"hannob/webminex","url":"https://github.com/hannob/webminex","stars":8,"created":"2019-12-25"},{"name":"n0obit4/Webmin_1.890-POC","url":"https://github.com/n0obit4/Webmin_1.890-POC","stars":7,"created":"2020-09-13"},{"name":"ruthvikvegunta/CVE-2019-15107","url":"https://github.com/ruthvikvegunta/CVE-2019-15107","stars":6,"created":"2020-08-08"}]},"metasploit":[{"name":"Webmin password_change.cgi Backdoor","module":"exploit/linux/http/webmin_backdoor","type":"exploit","disclosureDate":"2019-08-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_backdoor.rb"}],"nuclei":[{"id":"CVE-2019-15107","name":"Webmin <= 1.920 - Unauthenticated Remote Command Execution","severity":"critical","path":"http/cves/2019/CVE-2019-15107.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml"}],"first":{"date":"2019-08-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_backdoor.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html","http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html","http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html","http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html","https://www.exploit-db.com/exploits/47230","http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2019-08-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-08-12, PoC-in-GitHub 2019-08-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_backdoor.rb","provenance":"source"},{"date":"2019-08-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15107","provenance":"source"},{"date":"2019-12-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6178","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":952},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2509 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 33 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}