60
CVE-2019-15107
KEV ransomware PoC ×5massUnauthenticated Command Injection RCE in Webmin <= 1.920
CISA: Webmin Command Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
100%p100
Published
()
KEV added
AI analysis
CVE-2019-15107 is a critical (CVSS 9.8) unauthenticated command injection (CWE-78) in Webmin versions 1.920 and earlier, located in the 'old' parameter of password_change.cgi. An attacker can trigger it by sending a crafted, unauthenticated request to password_change.cgi with shell metacharacters in that parameter, causing arbitrary commands to execute on the server. Because Webmin typically runs with elevated privileges, successful exploitation yields full control of the host, and the flaw has seen real-world use including ransomware operations. Any system running Webmin 1.920 or older is affected, and related reporting indicates backdoored Webmin versions were available for download for over a year, so compromised installs may not be obvious. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-25) with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoCs exist, and the Roboto P2P botnet has been reported targeting Linux Webmin servers.
What to do: Upgrade Webmin to a version later than 1.920 per vendor instructions, which is CISA's required action for KEV listings. Because backdoored Webmin versions were reportedly distributed for over a year, also hunt for signs of compromise (unexpected processes, outbound connections, or a modified password_change.cgi) rather than only patching. Until updated, restrict access to the Webmin interface (default TCP port 10000) to trusted networks or place it behind a VPN.
Affected
| Webmin | <= 1.920 |
Estimated exposure
masson the order of 100,000+ internet-exposed Webmin servers — Webmin is one of the most widely deployed Linux/Unix server management interfaces, and public internet-wide scans of the Webmin interface have historically shown hundreds of thousands of exposed instances, so the population of systems…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
CISA Known Exploited Vulnerability
- Affected
- Webmin Webmin
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Known
- Vendors
- webmin
- Products
- webmin
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news5 stories
60
47
47
Mirai Variant V3G4 Targets IoT Devices
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
45