Threat reportVulnerabilityTL-2026-3903
Webmin password_change.cgi Backdoor Remote Code Execution (CVE-2019-15107) - DefCon Zero-Day Disclosure, TCP/10000 Scanning and Roboto P2P Botnet Exploitation
Webmin password_change.cgi Backdoor Remote Code Execution (TL-2026-3903), also tracked as Webmin backdoor, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-19. It has no confirmed attribution, affects Webmin Webmin (SourceForge-distributed builds), references 2 CVEs (CVE-2019-15107, CVE-2019-15231), maps to 9 MITRE ATT&CK techniques (T1036, T1049, T1059.004), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3903
- Threat ID
- TL-2026-3903
- Also known as
- Webmin backdoor, Webmin 1.920 Unauthenticated RCE
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- multiple
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Webmin password_change.cgi Backdoor Remote Code Execution
Malware and tooling: 60FF4A4203433AA2333A008C1B305CD80846834B9BE4BBA274F873831F04DF1C, Roboto, Metasploit: Webmin 1.920 Unauthenticated RCE, metasploit
How Webmin password_change.cgi Backdoor Remote Code Execution works
A malicious modification of Webmin's source (inserted on its build server in 2018 and shipped only in SourceForge downloads of versions 1.882-1.921) gave unauthenticated attackers root command execution through the 'old' parameter of password_change.cgi. The flaw was presented as a 0-day at DefCon on 2019-08-10 by Ozkan Mustafa Akkus, followed by increased TCP/10000 scanning, a public Metasploit module, exploitation by the Roboto P2P botnet and later CISA KEV listing (ransomware use 'Known').
Webmin is a web-based system administration interface for Unix/Linux that listens on TCP/10000 by default. CVE-2019-15107 (NVD: Webmin <= 1.920, parameter 'old' in password_change.cgi contains a command injection, CWE-78, CVSS 3.1 9.8) is a deliberately planted backdoor rather than an accidental bug. Per the Webmin project's own post-incident write-up, the development build server was compromised in April 2018 and a vulnerability was added to password_change.cgi with backdated timestamps so it would not show up in Git diffs; the attacker modified the file again in July 2018, this time embedding the exploit in code that only runs when password expiry changes are enabled. The compromised build server was decommissioned on 2018-09-10 but the vulnerable code was inadvertently copied to its replacement. Only the SourceForge downloads were backdoored, although they were listed as official downloads on the project site.
Mechanics: when password_change.cgi receives a POST to change a password, it takes the 'old' HTTP parameter and, when building the error string for an incorrect password, evaluates it as a shell command through Perl's qx operator. An unauthenticated remote attacker can therefore append a pipe plus a command to the 'old' field and run it as root. Webmin 1.890 is exploitable in the default installation; versions 1.900-1.920 are exploitable only if the 'expired password changing' feature (passwd_mode in /etc/webmin/miniserv.conf) is enabled. The public Exploit-DB/Metasploit proof of concept (EDB-47230, 'Webmin 1.920 Unauthenticated RCE', rank Excellent) POSTs to /password_change.cgi with a Referer of <host>/session_login.cgi, cookies 'redirect=1; testing=1; sid=x; sessiontest=1' and a body of user=root&pam=&expired=2&old=AkkuS|<PAYLOAD>&new1=akkuss&new2=akkuss.
Disclosure and scanning: the zero-day was presented at DefCon on 2019-08-10 by Ozkan Mustafa Akkus without advance notice to the maintainers. Team Cymru (2019-08-22) reported that its OpenPorts data showed slightly over 3,850,000 open TCP/10000 listeners over 45 days, and that its darknet data showed an uptick in scanning in the two days following the announcement plus a spike in late July, before the public presentation. Webmin 1.930, released 2019-08-17, removed the backdoor.
Exploitation in the wild: 360 Netlab first saw a suspicious ELF file on 2019-08-26 and on 2019-10-11 captured the Roboto bot, its downloader and modules on a honeypot; Trend Micro and Security Affairs reported it on 2019-11-21. Roboto is a peer-to-peer botnet with no central C2: the downloader fetches the bot from two hard-coded HTTP URLs, one disguising the sample as the Google font library 'roboto.ttc'; commands are authenticated with an ED25519 signature (embedded public key 60FF4A4203433AA2333A008C1B305CD80846834B9BE4BBA274F873831F04DF1C). Seven functions are reported: reverse shell, self-uninstall, gathering process/network information, gathering bot information, executing system commands, running encrypted files specified in URLs, and DDoS (ICMP, HTTP, TCP and UDP floods). No active DDoS was observed, suggesting the operators were still building the botnet. CISA added CVE-2019-15107 to the KEV catalog on 2022-03-25 (due 2022-04-15) and flags it as known to be used in ransomware campaigns.
Sourcing caveats: the Team Cymru article body could not be retrieved directly, so its figures come from the search-retrieved article summary as captured in the hunt skeleton. CVE-2019-15231 was assigned on 2019-08-20 and later REJECTED as a duplicate of CVE-2019-15107, although the Webmin advisory page still references it; only CVE-2019-15107 is recorded here. No attributed actor for the build-server compromise is named in any source, and no network IOCs (IPs/domains) were published in the sources reviewed; a BeaconBeagle domain query for webmin.com returned zero results.
MITRE ATT&CK techniques used in TL-2026-3903
Defense Evasion
T1036 Masquerading; T1070.006 Timestomp
Discovery
T1049 System Network Connections Discovery; T1082 System Information Discovery
Execution
Initial Access
T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain
Resource Development
Reconnaissance
Affected products and versions in Webmin password_change.cgi Backdoor Remote Code Execution
- Webmin — Webmin (SourceForge-distributed builds)
Vulnerable versions: 1.882 through 1.921 per vendor advisory (NVD: <= 1.920); 1.890 exploitable in default configuration; 1.900-1.920 exploitable only when expired password changing is enabled
Fixed in: 1.930
Remediation for Webmin password_change.cgi Backdoor Remote Code Execution
Patches
- Upgrade to Webmin 1.930 or later
Immediate actions
- Identify Webmin installs from SourceForge at versions 1.882-1.921 and upgrade to 1.930 or later
- Restrict TCP/10000 to trusted management networks and do not expose Webmin to the internet
- Hunt web/miniserv logs for POSTs to /password_change.cgi with a pipe character in the 'old' parameter
- Treat any host that ran an affected version while exposed as potentially compromised and investigate for Roboto indicators
Workarounds
- For 1.900-1.920: edit /etc/webmin/miniserv.conf, remove the passwd_mode= line, then run /etc/webmin/restart
- Version 1.890 is vulnerable by default, so upgrade rather than rely on the workaround
Longer-term hardening
- Verify package integrity and source (do not rely on a single mirror) for administrative tooling
- Place administration interfaces behind VPN or an authenticating reverse proxy
- Deploy EDR/behavioral monitoring for shells spawned by the Webmin miniserv process
CVEs associated with Webmin password_change.cgi Backdoor Remote Code Execution
Weaknesses (CWE) in Webmin password_change.cgi Backdoor Remote Code Execution
Timeline of Webmin password_change.cgi Backdoor Remote Code Execution
- April 2018: Webmin development build server compromised and a vulnerability added to password_change.cgi with backdated timestamps (introduced in release 1.890).
- July 2018: attacker modified the file again, embedding the exploit in code that runs only when password expiry changes are enabled (affects 1.900-1.920).
- Compromised build server decommissioned; the vulnerable code was inadvertently copied to its replacement.
- Ozkan Mustafa Akkus presents the Webmin zero-day RCE at DefCon without advance notice to maintainers.
- Metasploit-based exploit 'Webmin 1.920 Unauthenticated RCE' posted to Exploit-DB (EDB-47230).
- NVD publishes CVE-2019-15107 (CVSS 3.1 9.8, CWE-78).
- Webmin 1.930 released with the backdoor removed.
- Team Cymru reports ~3.85M open TCP/10000 listeners over 45 days and a scanning uptick in the two days after the announcement.
- 360 Netlab first sees a suspicious ELF file later attributed to the Roboto botnet.
- Netlab honeypot captures the Roboto bot, downloader and modules.
- Trend Micro and Security Affairs publish on Roboto P2P botnet exploiting CVE-2019-15107.
- CISA adds CVE-2019-15107 to KEV (due 2022-04-15), flagged as known to be used in ransomware campaigns.
Sources cited for Webmin password_change.cgi Backdoor Remote Code Execution
- Webmin Vulnerability and Port Scanning Activity - Team Cymru
- NVD - CVE-2019-15107
- Webmin project - Security exploit / backdoor write-up
- Exploit-DB 47230 - Webmin 1.920 Unauthenticated RCE (Metasploit)
- CISA KEV - CVE-2019-15107 Webmin Command Injection Vulnerability
- Roboto Botnet Targets Servers Running Webmin by Exploiting CVE-2019-15107 - Trend Micro
- Roboto P2P botnet - Security Affairs
- NVD - CVE-2019-15231 (rejected duplicate of CVE-2019-15107)
Detection coverage for TL-2026-3903
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3903 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.