CVE-2019-15107
Webmin Command Injection Vulnerability
Description
CVE-2019-15107 is a critical-severity OS command injection vulnerability in Webmin, the widely used web-based system administration tool. The old parameter in password_change.cgi fails to neutralize shell metacharacters, allowing a remote, unauthenticated attacker to inject and execute arbitrary operating-system commands on the server. Because the affected code path runs as root, exploitation typically yields complete server takeover, and the flaw originated from malicious code introduced into the Webmin build — effectively a backdoor — in versions up to and including 1.920. With a CVSS score of 9.8, an EPSS score of 94.5% (99.99th percentile), confirmed use in ransomware campaigns, and a CISA KEV listing, CVE-2019-15107 is among the most reliably exploited Webmin vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| webmin | webmin | <= 1.920 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html(Exploit, Third Party Advisory)
- http://www.webmin.com/security.html(Vendor Advisory)
- https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection(Third Party Advisory)
- https://www.exploit-db.com/exploits/47230(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15107(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In Webmin's password_change.cgi, the old parameter is passed into an operating-system command without proper neutralization of shell metacharacters, so attacker-supplied input is interpreted as part of the command. This lets an unauthenticated attacker append arbitrary commands that the server executes, leading to full remote code execution.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2019-15107 carries a CVSS 3.1 score of 9.8 (CRITICAL). It is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, and fully compromises the confidentiality, integrity, and availability of the affected server because the injected commands run with the privileges of the Webmin process — typically root. The EPSS score of 94.5% places it in the 99.99th percentile, indicating near-certain exploitation activity, and CISA has flagged this vulnerability as known to be used in ransomware campaigns. Webmin is commonly exposed to manage servers, so an unauthenticated root-level command injection on an internet-facing instance is an immediate path to full server compromise and ransomware deployment.
Exploit Maturity
CVE-2019-15107 has an extremely mature exploit landscape. Public exploit code is widely available, including the Exploit-DB module and multiple Packet Storm Security entries, and it is implemented in common penetration-testing frameworks. CISA confirms active exploitation through its KEV listing and flags the vulnerability as known to be used in ransomware campaigns, while the EPSS score of 94.5% (99.99th percentile) indicates near-certain exploitation. Because the flaw stems from a backdoor in the affected Webmin builds and is trivially exploitable without authentication, it has been a favorite of automated scanners and crimeware operators; any exposed vulnerable Webmin instance should be considered at immediate risk.
Remediation
- Apply updates per vendor instructions as required by the CISA KEV listing: upgrade Webmin to a fixed release beyond 1.920 (the vulnerable code was removed in 1.930), per the Webmin security advisory.
- Do not expose the Webmin interface directly to the internet — restrict access via firewall rules, VPN, or IP allowlisting so the password_change.cgi endpoint is not reachable by untrusted clients.
- Because exploitation grants root-level command execution, treat any potentially compromised instance as fully breached: inspect for webshells, unauthorized cron jobs, new accounts, and signs of ransomware deployment, and rebuild from known-good media if compromise is confirmed.
- Monitor web and system logs for requests to password_change.cgi containing shell metacharacters in the
oldparameter and for anomalous process execution by the Webmin service. - As long-term hardening against OS command injection, ensure administrative tools validate and neutralize all user input before passing it to shells, prefer APIs that avoid shell invocation, and keep management software on supported, patched versions.
Technical Details
CVE-2019-15107 is an OS command injection vulnerability (CWE-78) in Webmin versions up to and including 1.920. The old parameter in password_change.cgi is incorporated into an operating-system command without neutralizing shell metacharacters, so an unauthenticated attacker can inject additional commands that the server executes — and because the handler runs with high privilege, this results in root-level remote code execution. The vulnerability was introduced through malicious code added to the Webmin build (a backdoor), making the exploit path deterministic and reliable. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated attack with full impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2019-15107 being actively exploited?
Yes. CVE-2019-15107 is on the CISA Known Exploited Vulnerabilities catalog and is flagged as known to be used in ransomware campaigns. Its EPSS score of 94.5% (99.99th percentile) confirms near-certain exploitation, and public exploit code is widely available, so any exposed vulnerable instance faces immediate risk.
What products are affected by CVE-2019-15107?
The vulnerability affects Webmin versions up to and including 1.920, where malicious code in the build introduced the command injection in password_change.cgi. It was fixed in Webmin 1.930.
How do I fix CVE-2019-15107?
Upgrade Webmin to a fixed release beyond 1.920 (1.930 or later). Restrict access to the Webmin interface so it is not exposed to the internet, and if you suspect compromise, perform incident response and rebuild from known-good media.
How severe is CVE-2019-15107?
CVE-2019-15107 is rated CRITICAL with a CVSS 3.1 score of 9.8. It enables unauthenticated, remote, root-level command execution and is confirmed to be used in ransomware campaigns, making it one of the most dangerous Webmin vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.