Webmin password_change.cgi Unauthenticated Remote Command Execution (RCE) (CVE-2019-15107)
Executive & SecOps Summary
SECOPS ASSESSMENTWebmin versions 1.920 and prior (with password change feature enabled)
Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending a specially crafted HTTP POST request.
Immediately upgrade Webmin to the latest secure version (1.930 or higher) or disable the password_change.cgi script.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade Webmin to the latest patched version (1.930 or higher) using your system package manager.
# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get --only-upgrade install webmin -y
# For RedHat/CentOS-based systems
sudo yum update webmin -y2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable the password change feature in the Webmin configuration or revoke execution permissions on the vulnerable CGI script.
# 1. Disable password change feature in miniserv.conf
sudo sed -i 's/passwd_mode=[0-9]/passwd_mode=0/g' /etc/webmin/miniserv.conf
sudo systemctl restart webmin
# 2. Remove execution permissions from the vulnerable script
sudo chmod 000 /usr/share/webmin/password_change.cgi3. Log Audit & IoC Verification Commands
Inspect Webmin access logs for suspicious POST requests targeting the password_change.cgi endpoint.
# Search for password_change.cgi access attempts in Webmin logs
sudo grep 'password_change.cgi' /var/webmin/miniserv.log
# Verify the currently installed Webmin version
/usr/share/webmin/versionBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical command injection flaw located in the password_change.cgi component of Webmin, a web-based system administration interface for Unix-like systems. The root cause lies in the lack of input validation and sanitization of the old parameter within the password change request. A backdoor-like code structure allowed user input containing shell metacharacters to be passed directly to system command execution functions (such as qx/../ or backticks) without proper filtering.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the Webmin port (default 10000) targeting password_change.cgi. By populating the request body with parameters like user=root&pam=&expired=2&old=test|id&new1=test&new2=test, the attacker injects arbitrary OS commands via the old parameter using shell metacharacters like | or ;. Because this endpoint processes the request before verifying the user's current session or credentials, it allows full unauthenticated remote code execution.
3. Infrastructure & Business Impact
Since Webmin typically runs with root privileges, any commands executed through this vulnerability will run with administrative access. This allows attackers to compromise the entire host, exfiltrate sensitive data, deploy malware, or pivot into the internal network. Given that this vulnerability has been actively exploited in the wild (listed in CISA KEV) and has an extremely high EPSS score, it poses an immediate threat to any exposed Webmin instances.
Official Vendor Advisories & References
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Frequently Asked SecOps Questions (CVE-2019-15107)
FAQQ1. How critical is CVE-2019-15107 and is it actively exploited in the wild?
CVE-2019-15107 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-15107?
Primary impacted vendors include webmin across webmin. Scope summary: Webmin versions 1.920 and below (specifically when password change and expiration features are active)
Q3. What temporary mitigations or workarounds exist for CVE-2019-15107 before patching?
[Mitigation] Immediately upgrade Webmin to the latest secure version (1.930 or higher) or disable the password_change.cgi script. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-15107
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (webmin)
View Category →LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.