CVE-2019-15107

CVE-2019-15107 is a critical (CVSS 9.8) unauthenticated command injection (CWE-78) in Webmin versions 1.920 and earlier, located in the 'old' parameter of password_change.cgi. An attacker can trigger it by sending a crafted, unauthenticated request to password_change.cgi with shell metacharacters in that parameter, causing arbitrary commands to execute on the server. Because Webmin typically runs with elevated privileges, successful exploitation yields full control of the host, and the flaw has seen real-world use including ransomware operations. Any system running Webmin 1.920 or older is affected, and related reporting indicates backdoored Webmin versions were available for download for over a year, so compromised installs may not be obvious. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-25) with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoCs exist, and the Roboto P2P botnet has been reported targeting Linux Webmin servers.

What to do: Upgrade Webmin to a version later than 1.920 per vendor instructions, which is CISA's required action for KEV listings. Because backdoored Webmin versions were reportedly distributed for over a year, also hunt for signs of compromise (unexpected processes, outbound connections, or a modified password_change.cgi) rather than only patching. Until updated, restrict access to the Webmin interface (default TCP port 10000) to trusted networks or place it behind a VPN.