# Webmin password_change.cgi Backdoor Remote Code Execution (CVE-2019-15107) - DefCon Zero-Day Disclosure, TCP/10000 Scanning and Roboto P2P Botnet Exploitation

> A malicious modification of Webmin's source (inserted on its build server in 2018 and shipped only in SourceForge downloads of versions 1.882-1.921) gave unauthenticated attackers root command execution through the 'old' parameter of password_change.cgi. The flaw was presented as a 0-day at DefCon on 2019-08-10 by Ozkan Mustafa Akkus, followed by increased TCP/10000 scanning, a public Metasploit module, exploitation by the Roboto P2P botnet and later CISA KEV listing (ransomware use 'Known').

- **Published:** 2026-10-19T16:56:51Z
- **Last reviewed:** 2026-10-19T16:56:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3903
- **ID:** TL-2026-3903
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-15107, CVE-2019-15231

## Description

Webmin is a web-based system administration interface for Unix/Linux that listens on TCP/10000 by default. CVE-2019-15107 (NVD: Webmin <= 1.920, parameter 'old' in password_change.cgi contains a command injection, CWE-78, CVSS 3.1 9.8) is a deliberately planted backdoor rather than an accidental bug. Per the Webmin project's own post-incident write-up, the development build server was compromised in April 2018 and a vulnerability was added to password_change.cgi with backdated timestamps so it would not show up in Git diffs; the attacker modified the file again in July 2018, this time embedding the exploit in code that only runs when password expiry changes are enabled. The compromised build server was decommissioned on 2018-09-10 but the vulnerable code was inadvertently copied to its replacement. Only the SourceForge downloads were backdoored, although they were listed as official downloads on the project site.

Mechanics: when password_change.cgi receives a POST to change a password, it takes the 'old' HTTP parameter and, when building the error string for an incorrect password, evaluates it as a shell command through Perl's qx operator. An unauthenticated remote attacker can therefore append a pipe plus a command to the 'old' field and run it as root. Webmin 1.890 is exploitable in the default installation; versions 1.900-1.920 are exploitable only if the 'expired password changing' feature (passwd_mode in /etc/webmin/miniserv.conf) is enabled. The public Exploit-DB/Metasploit proof of concept (EDB-47230, 'Webmin 1.920 Unauthenticated RCE', rank Excellent) POSTs to /password_change.cgi with a Referer of <host>/session_login.cgi, cookies 'redirect=1; testing=1; sid=x; sessiontest=1' and a body of user=root&pam=&expired=2&old=AkkuS|<PAYLOAD>&new1=akkuss&new2=akkuss.

Disclosure and scanning: the zero-day was presented at DefCon on 2019-08-10 by Ozkan Mustafa Akkus without advance notice to the maintainers. Team Cymru (2019-08-22) reported that its OpenPorts data showed slightly over 3,850,000 open TCP/10000 listeners over 45 days, and that its darknet data showed an uptick in scanning in the two days following the announcement plus a spike in late July, before the public presentation. Webmin 1.930, released 2019-08-17, removed the backdoor.

Exploitation in the wild: 360 Netlab first saw a suspicious ELF file on 2019-08-26 and on 2019-10-11 captured the Roboto bot, its downloader and modules on a honeypot; Trend Micro and Security Affairs reported it on 2019-11-21. Roboto is a peer-to-peer botnet with no central C2: the downloader fetches the bot from two hard-coded HTTP URLs, one disguising the sample as the Google font library 'roboto.ttc'; commands are authenticated with an ED25519 signature (embedded public key 60FF4A4203433AA2333A008C1B305CD80846834B9BE4BBA274F873831F04DF1C). Seven functions are reported: reverse shell, self-uninstall, gathering process/network information, gathering bot information, executing system commands, running encrypted files specified in URLs, and DDoS (ICMP, HTTP, TCP and UDP floods). No active DDoS was observed, suggesting the operators were still building the botnet. CISA added CVE-2019-15107 to the KEV catalog on 2022-03-25 (due 2022-04-15) and flags it as known to be used in ransomware campaigns.

Sourcing caveats: the Team Cymru article body could not be retrieved directly, so its figures come from the search-retrieved article summary as captured in the hunt skeleton. CVE-2019-15231 was assigned on 2019-08-20 and later REJECTED as a duplicate of CVE-2019-15107, although the Webmin advisory page still references it; only CVE-2019-15107 is recorded here. No attributed actor for the build-server compromise is named in any source, and no network IOCs (IPs/domains) were published in the sources reviewed; a BeaconBeagle domain query for webmin.com returned zero results.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1059.004 Unix Shell
- T1070.006 Timestomp
- T1036 Masquerading
- T1082 System Information Discovery
- T1049 System Network Connections Discovery

## Sources

- [Webmin Vulnerability and Port Scanning Activity - Team Cymru](https://www.team-cymru.com/post/webmin-vulnerability-and-port-scanning-activity)
- [NVD - CVE-2019-15107](https://nvd.nist.gov/vuln/detail/CVE-2019-15107)
- [Webmin project - Security exploit / backdoor write-up](https://www.webmin.com/exploit.html)
- [Exploit-DB 47230 - Webmin 1.920 Unauthenticated RCE (Metasploit)](https://www.exploit-db.com/exploits/47230)
- [CISA KEV - CVE-2019-15107 Webmin Command Injection Vulnerability](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15107)
- [Roboto Botnet Targets Servers Running Webmin by Exploiting CVE-2019-15107 - Trend Micro](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/roboto-botnet-targets-servers-running-webmin-by-exploiting-cve-2019-15107)
- [Roboto P2P botnet - Security Affairs](https://securityaffairs.com/94169/malware/roboto-p2p-botnet.html)
- [NVD - CVE-2019-15231 (rejected duplicate of CVE-2019-15107)](https://nvd.nist.gov/vuln/detail/CVE-2019-15231)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3903