CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-13313 – Admin Password returned in password.htm
https://notcve.org/view.php?id=CVE-2018-13313
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext. En TOTOLINK A3002RU versión 1.0.8, el enrutador proporciona una página que permite al usuario cambiar su nombre de cuenta y contraseña. Esta página, password.htm, contiene JavaScript que es utilizado para confirmar que el usuario conozca su contraseña actual antes de permitirle cambiar su contraseña. • https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 https://www.ise.io/casestudies/sohopelessly-broken-2-0 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 9.0EPSS: 91%CPEs: 16EXPL: 4CVE-2019-19824 – Realtek SDK Information Disclosure / Code Execution
https://notcve.org/view.php?id=CVE-2019-19824
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0. En determinados enrutadores basados ??en TOTOLINK Realtek SDK, un atacante autenticado puede ejecutar comandos arbitrarios de Sistema Operativo por medio del parámetro sysCmd en el URI boafrm/formSysCmd, inclusive si la GUI (syscmd.htm) no está disponible. • http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html http://seclists.org/fulldisclosure/2020/Jan/36 http://seclists.org/fulldisclosure/2020/Jan/38 https://sploit.tech https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 1CVE-2019-19825 – Realtek SDK Information Disclosure / Code Execution
https://notcve.org/view.php?id=CVE-2019-19825
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0. En determinados enrutadores basados ?? • http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html http://seclists.org/fulldisclosure/2020/Jan/36 http://seclists.org/fulldisclosure/2020/Jan/38 https://sploit.tech • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 36EXPL: 3CVE-2019-19823 – Realtek SDK Information Disclosure / Code Execution
https://notcve.org/view.php?id=CVE-2019-19823
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12. Una determinada interfaz de administración de enrutador (que incluye Realtek APMIB versión 0.11f para Boa versión 0.94.14rc21), almacena contraseñas administrativas de texto sin cifrar en la memoria flash y en un archivo. Esto afecta a TOTOLINK A3002RU versiones hasta 2.0.0, A702R versiones hasta 2.1.3, N301RT versiones hasta 2.1.6, N302R versiones hasta 3.4.0, N300RT versiones hasta 3.4.0, N200RE versiones hasta 4.0.0, N150RT versiones hasta 3.4.0 y N100RE versiones hasta 3.4. 0; Rutek RTK 11N AP hasta el 12-12-2019; Sapido GR297n hasta el 12-12-2019; ROUTER CIK TELECOM MESH hasta 12-12-2019; KCTVJEJU Wireless AP hasta el 12-12-2019; Fibergate FGN-R2 hasta el 12-12-2019; Hi-Wifi MAX-C300N hasta el 12-12-2019; HCN MAX-C300N hasta el 12-12-2019; GN-866ac T-wide hasta el 12-12-2019; Coship EMTA AP hasta el 12-12-2019; y IO-Data WN-AC1167R hasta el 12-12-2019. Realtek SDK based routers suffer from information disclosure, incorrect access control, insecure password storage, code execution, and incorrectly implemented CAPTCHA vulnerabilities. • http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html http://seclists.org/fulldisclosure/2020/Jan/36 http://seclists.org/fulldisclosure/2020/Jan/38 https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h#L13 https://sploit.tech • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 1%CPEs: 36EXPL: 3CVE-2019-19822 – Realtek SDK Information Disclosure / Code Execution
https://notcve.org/view.php?id=CVE-2019-19822
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12. Una determinada interfaz de administración de enrutador (que incluye Realtek APMIB versión 0.11f para Boa versión 0.94.14rc21), permite a atacantes remotos recuperar la configuración, incluidos los datos confidenciales (nombres de usuario y contraseñas). Esto afecta a TOTOLINK A3002RU versiones hasta 2.0.0, A702R versiones hasta 2.1.3, N301RT versiones hasta 2.1.6, N302R versiones hasta 3.4.0, N300RT versiones hasta 3.4.0, N200RE versiones hasta 4.0.0, N150RT versiones hasta 3.4.0 y N100RE versiones hasta 3.4. 0; Rutek RTK 11N AP hasta el 12-12-2019; Sapido GR297n hasta el 12-12-2019; ROUTER CIK TELECOM MESH hasta el 12-12-2019; KCTVJEJU Wireless AP hasta el 12-12-2019; Fibergate FGN-R2 hasta el 12-12-2019; Hi-Wifi MAX-C300N hasta el 12-12-2019; HCN MAX-C300N hasta el 12-12-2019; GN-866ac T-wide hasta el 12-12-2019; Coship EMTA AP hasta el 12-12-2019; y IO-Data WN-AC1167R hasta el 12-12-2019. Realtek SDK based routers suffer from information disclosure, incorrect access control, insecure password storage, code execution, and incorrectly implemented CAPTCHA vulnerabilities. • http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html http://seclists.org/fulldisclosure/2020/Jan/36 http://seclists.org/fulldisclosure/2020/Jan/38 https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h#L13 https://sploit.tech • CWE-306: Missing Authentication for Critical Function •