← Vulnerability feed

Vulnerability record · CVE-2019-15990 · published 26 November 2019

CVE-2019-15990: Cisco rv016 multi-wan vpn firmware improper authorization vulnerability

Cisco · Rv016 Multi Wan Vpn Firmware

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.

5.3 CVSS 3.1 Medium EPSS 1.2% · top 33.2% CWE-285 · Improper authorization
5.3CVSS 3.1 base score, v2 5.0
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-sbr-rv-infodis Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-sbr-rv-infodis Vendor Advisory

Track CVE-2019-15990 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2019-15271Cisco RV Series Routers web interface command injection via untrusted deserializationThe web-based management interface of several Cisco Small Business RV Series Routers fails to validate HTTP payload input, allowing deserialization o…KEVEPSS 5.5%analysed7.2CVE-2019-15957Cisco rv016 multi-wan vpn firmware improper input validation vulnerabilityA vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker…EPSS 3.2%4.3CVE-2015-6418Cisco sa520 information exposure vulnerabilityThe random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes…EPSS 1.8%8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed9.8CVE-2021-28799QNAP HBS 3 improper authorization allows remote loginQNAP Hybrid Backup Sync 3 (HBS 3) contains an improper authorization flaw that lets remote attackers log in to the NAS device. The issue affects mult…KEVEPSS 78%analysed

Source: NIST National Vulnerability Database (record CVE-2019-15990), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.