CVE-2019-15990: Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-26 · updated 2026-06-17
Weakness: CWE-285

Description

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.

Affected products

Cisco Rv016 Multi-Wan Vpn Firmware: before 4.2.3.10 — fixed in 4.2.3.10
Cisco Rv042 Dual Wan Vpn Firmware: before 4.2.3.10 — fixed in 4.2.3.10
Cisco Rv042G Dual Gigabit Wan Vpn Firmware: before 4.2.3.10 — fixed in 4.2.3.10
Cisco Rv082 Dual Wan Vpn Firmware: before 4.2.3.10 — fixed in 4.2.3.10

How to fix

Upgrade to a fixed version: Cisco Rv016 Multi-Wan Vpn Firmware 4.2.3.10; Cisco Rv042 Dual Wan Vpn Firmware 4.2.3.10; Cisco Rv042G Dual Gigabit Wan Vpn Firmware 4.2.3.10; Cisco Rv082 Dual Wan Vpn Firmware 4.2.3.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-15990 or the next vulnerability affects your stack