Netis WF2419 Firmware V1.2.31805 and V2.2.36123 - Authenticated Remote Code Execution via Tracert Diagnostic Tool
Title source: llmExploitation Summary
CVE-2019-19356 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 2 public exploits from researchers including shadowgatt, qq1515406085.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2019-19356, targeting Netis WF2419 routers. The exploit leverages command injection via the 'tracert' diagnostic tool to achieve authenticated remote code execution (RCE) as root.
Description
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
Exploits (2)
The repository contains a functional Python exploit for CVE-2019-19356, targeting Netis WF2419 routers. The exploit leverages command injection via the 'tracert' diagnostic tool to achieve authenticated remote code execution (RCE) as root.
The repository contains only a Docker Compose file and a minimal README with no exploit code or technical details. It sets up a Discuz ML environment but does not demonstrate or explain the vulnerability.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H