opensource.actiontec.com
http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz CVE-2019-19822
HIGHNuclei
TOTOLINK/Realtek Routers - Information Disclosure
Record summary
CVE-2019-19822 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
Nuclei templates
1ProjectDiscoveryHIGHTOTOLINK/Realtek Routers - Information DisclosureCVSS 7.5
A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.
Impact
Unauthenticated attackers can retrieve the entire router configuration including Wi-Fi passwords, admin credentials, and network settings, enabling complete network takeover.
Remediation
Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
WeaknessesCWE-306
Authorsritikchaddha
Template tagscvecve2019totolinkrealtekinformation-disclosureconfigboa
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
FOFA: title="totolink"
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html https://nvd.nist.gov/vuln/detail/CVE-2019-19822
Source: ProjectDiscovery
References
7packetstormsecurity.com
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html 20200124 Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routersmailing list
http://seclists.org/fulldisclosure/2020/Jan/36 20200131 Re: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routersmailing list
http://seclists.org/fulldisclosure/2020/Jan/38 github.com
https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-19822 sploit.tech
https://sploit.tech/