Webmin Command Injection Vulnerability (CVE-2019-15107)

What is affected, what to do

An attacker can achieve full control over a system by exploiting a command injection vulnerability in Webmin versions up to 1.920. The vulnerability lies in the `password_change.cgi` script, where the `old` parameter can be manipulated. This vulnerability is actively exploited in ransomware campaigns since its inclusion in the CISA KEV in 2022. Affected organizations should urgently upgrade to the latest version of Webmin to mitigate the risk. The high exploit maturity highlights the urgency of this response.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Webmin lte *..1.920

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every Webmin instance, including those on appliances, hosting panels and forgotten admin VMs. Scan for the default port 10000/tcp (HTTP/HTTPS, MiniServ banner) and check locally via /etc/webmin/version, rpm -q webmin or dpkg -l webmin. All versions ≤ 1.920 are affected.
   • Patch: Upgrade to a Webmin release above 1.920; confirm the exact fixed version in the vendor advisory. Install only from the official Webmin repository with signature verification. The flaw originated in a compromise of the build infrastructure, so verify package provenance before installing.
   • Isolate if you cannot patch now: Block 10000/tcp at perimeter and internal firewalls for all sources except a dedicated admin jump host. Internet-facing instances come first – this is not a "patch at the weekend" item.
   • Disable the vulnerable feature: In /etc/webmin/miniserv.conf, set passwd_mode to 0. This turns off expired-password changes, which is the code path that reaches password_change.cgi. Then restart Webmin (systemctl restart webmin or /etc/webmin/restart).
   • Compromise assessment: Treat any instance that was reachable before mitigation as potentially compromised, because Webmin runs as root. Review miniserv.log, cron jobs, authorized_keys, and any new users or services. If you find indicators, rebuild the host rather than cleaning it, and rotate every credential stored on it (SSH keys, database and service accounts).
   • Rotate credentials: Reset Webmin admin and root passwords on affected hosts, even without evidence of compromise.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Run Webmin only on a management VLAN, reachable solely via a bastion host or an MFA-protected VPN. Apply default-deny for 10000/tcp from user, DMZ and internet zones.
   • Application configuration: Restrict the allow= directive in miniserv.conf to admin IPs, so the web server itself enforces an IP allowlist. Keep referers_none=1 and remove unused modules.
   • WAF/IPS: Block POSTs to /password_change.cgi where old (or new1/new2) contains shell metacharacters such as |, ;, `, $( or &&. Example Suricata rule idea: http.uri; content:"/password_change.cgi"; http.request_body; pcre:"/old=[^&]*(%7c|\||%3b|;|%60||$()/i";`. Enable the vendor IPS signatures for Webmin RCE and set them to blocking mode.
   • Endpoint hardening: Use EDR policy or AppArmor/SELinux to stop the miniserv.pl Perl process from spawning shells, curl, wget, nc or python. Restrict egress from Webmin hosts to required update endpoints only.
   • Retire where possible: If Webmin is not essential, disable it (systemctl disable --now webmin) and administer the host via key-based SSH. This removes the attack surface permanently.
3. 03

   Runbook step 3

   Detection rules

   • Web server log (/var/webmin/miniserv.log): Look for POSTs to /password_change.cgi, especially with a /session_login.cgi referer from external sources. SPL example: index=linux sourcetype=webmin uri="/password_change.cgi" method=POST | stats count by src_ip. Treat any hit from a non-admin network as an incident.
   • Network telemetry (Zeek/Suricata): Filter http.log for uri == "/password_change.cgi" on port 10000. Where TLS is terminated, inspect the request body for old= containing URL-encoded pipes (%7c) or semicolons (%3b).
   • Process ancestry (EDR/Sysmon for Linux EID 1): Flag a perl/miniserv.pl parent spawning sh, bash, dash, curl, wget, nc, python*, base64 or chmod. Sigma shape: ParentCommandLine|contains: 'miniserv' AND Image|endswith: ['/sh','/bash','/curl','/wget','/nc'].
   • auditd: Add -a always,exit -F arch=b64 -S execve -F uid=0 -k webmin_exec, then filter for execve events whose ppid belongs to the miniserv process. Also add -w /etc/webmin/ -p wa -k webmin_cfg to catch configuration tampering.
   • Post-exploitation: Watch for new entries in /etc/crontab, /var/spool/cron/ and ~root/.ssh/authorized_keys, and for outbound connections from the Webmin host to unfamiliar IPs (cryptominers, botnet C2, ransomware staging).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST)

Vendors and products

• Webmin Webmin

References & sources

• webmin.comsecurity.htmlx_refsource_MISC
• exploit-db.comexploits/47230x_refsource_MISC
• pentest.com.trexploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Exec…x_refsource_MISC
• packetstormsecurity.comfiles/154141/Webmin-Remote-Comman-Execution.htmlx_refsource_MISC
• packetstormsecurity.comfiles/154141/Webmin-1.920-Remote-Command-Execution.htmlx_refsource_MISC
• packetstormsecurity.comfiles/154197/Webmin-1.920-password_change.cgi-Backdoor.htmlx_refsource_MISC
• packetstormsecurity.comfiles/154485/Webmin-1.920-Remote-Code-Execution.htmlx_refsource_MISC
• attackerkb.comtopics/hxx3zmiCkR/webmin-password-change-cgi-command-injectionx_refsource_MISC
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15107government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2019-15107","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T20:29:55.177689Z"}	{"id":"CVE-2019-15107","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2022-03-11T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2019-15107","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"slow"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2022-03-11T00:00:00+00:00"}	{"id":"CVE-2019-15107","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T20:29:55.177689Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0