CVE-2019-19825

CRITICALNuclei

totolink a3002ru Improper Authentication

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-19825 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 23, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

a3002ru

Browse totolink / a3002ru
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALTOTOLINK/Realtek Routers - CAPTCHA BypassCVSS 9.8

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.

Impact

Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise.

Remediation

Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.

WeaknessesCWE-287
Authorsritikchaddha
Template tagscvecve2019totolinkrealtekcaptchabypassvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Shodan: http.html:"TOTOLINK"
FOFA: title="totolink"
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html https://nvd.nist.gov/vuln/detail/CVE-2019-19825

Source: ProjectDiscovery

References

5