CVE-2019-19825

Realtek SDK Information Disclosure / Code Execution

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

En determinados enrutadores basados ??en SDK TOTOLINK Realtek, el texto CAPTCHA puede ser recuperado mediante un POST {"topicurl":"setting/getSanvas"} en el URI boafrm/formLogin, conllevando a una omisión de CAPTCHA. (Además, el texto de CAPTCHA no es necesario una vez que el atacante ha determinado unas credenciales válidas. El atacante puede realizar acciones de enrutador por medio de peticiones HTTP con autenticación básica). Esto afecta a A3002RU versiones hasta 2.0.0, A702R versiones hasta 2.1.3, N301RT versiones hasta 2.1.6 , N302R versiones hasta 3.4.0, N300RT versiones hasta 3.4.0, N200RE versiones hasta 4.0.0, N150RT versiones hasta 3.4.0 y N100RE versiones hasta 3.4.0.

Realtek SDK based routers suffer from information disclosure, incorrect access control, insecure password storage, code execution, and incorrectly implemented CAPTCHA vulnerabilities.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-16 CVE Reserved
2020-01-24 CVE Published
2024-08-05 CVE Updated
2024-08-05 First Exploit
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-287: Improper Authentication

CAPEC

References (4)

URL	Tag	Source
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html	Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/36	Mailing List
http://seclists.org/fulldisclosure/2020/Jan/38	Mailing List

URL	Date	SRC
https://sploit.tech	2024-08-05

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Totolink Search vendor "Totolink"	A3002ru Firmware Search vendor "Totolink" for product "A3002ru Firmware"	<= 2.0.0 Search vendor "Totolink" for product "A3002ru Firmware" and version " <= 2.0.0"	-	Affected	in	Totolink Search vendor "Totolink"	A3002ru Search vendor "Totolink" for product "A3002ru"	-	-	Safe
Totolink Search vendor "Totolink"	A702r Firmware Search vendor "Totolink" for product "A702r Firmware"	<= 2.1.3 Search vendor "Totolink" for product "A702r Firmware" and version " <= 2.1.3"	-	Affected	in	Totolink Search vendor "Totolink"	A702r Search vendor "Totolink" for product "A702r"	-	-	Safe
Totolink Search vendor "Totolink"	N301rt Firmware Search vendor "Totolink" for product "N301rt Firmware"	<= 2.1.6 Search vendor "Totolink" for product "N301rt Firmware" and version " <= 2.1.6"	-	Affected	in	Totolink Search vendor "Totolink"	N301rt Search vendor "Totolink" for product "N301rt"	-	-	Safe
Totolink Search vendor "Totolink"	N302r Firmware Search vendor "Totolink" for product "N302r Firmware"	<= 3.4.0 Search vendor "Totolink" for product "N302r Firmware" and version " <= 3.4.0"	-	Affected	in	Totolink Search vendor "Totolink"	N302r Search vendor "Totolink" for product "N302r"	-	-	Safe
Totolink Search vendor "Totolink"	N300rt Firmware Search vendor "Totolink" for product "N300rt Firmware"	<= 3.4.0 Search vendor "Totolink" for product "N300rt Firmware" and version " <= 3.4.0"	-	Affected	in	Totolink Search vendor "Totolink"	N300rt Search vendor "Totolink" for product "N300rt"	-	-	Safe
Totolink Search vendor "Totolink"	N200re Firmware Search vendor "Totolink" for product "N200re Firmware"	<= 4.0.0 Search vendor "Totolink" for product "N200re Firmware" and version " <= 4.0.0"	-	Affected	in	Totolink Search vendor "Totolink"	N200re Search vendor "Totolink" for product "N200re"	-	-	Safe
Totolink Search vendor "Totolink"	N150rt Firmware Search vendor "Totolink" for product "N150rt Firmware"	<= 3.4.0 Search vendor "Totolink" for product "N150rt Firmware" and version " <= 3.4.0"	-	Affected	in	Totolink Search vendor "Totolink"	N150rt Search vendor "Totolink" for product "N150rt"	-	-	Safe
Totolink Search vendor "Totolink"	N100re Firmware Search vendor "Totolink" for product "N100re Firmware"	<= 3.4.0 Search vendor "Totolink" for product "N100re Firmware" and version " <= 3.4.0"	-	Affected	in	Totolink Search vendor "Totolink"	N100re Search vendor "Totolink" for product "N100re"	-	-	Safe