CVE-2019-19142: Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.

PriorityP264high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

EXPLOIT

EPSS

7.81%

93.9th percentile

Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
intelbras	wrn_240_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://192.168.0.1/incoming/RouterBakCfgUpload.cfg↗

path/incoming/RouterBakCfgUpload.cfg↗

path/incoming/Firmware.cfg↗

commandcurl -i -X POST -H "Content-Type: multipart/form-data" -H "Referer: http://192.168.0.1/userRpm/BakNRestoreRpm.htm" -F [email protected] http://192.1680.1/incoming/RouterBakCfgUpload.cfg↗

→Detect unauthenticated HTTP POST requests to the /incoming/Firmware.cfg or /incoming/RouterBakCfgUpload.cfg endpoints on Intelbras WRN240 devices — no session/auth cookie required by the device, so any POST to these paths from an unexpected source is suspicious. ↗
→Look for HTTP POST requests with Content-Type: multipart/form-data and a Referer header of http://192.168.0.1/userRpm/BakNRestoreRpm.htm targeting /incoming/RouterBakCfgUpload.cfg — this matches the documented PoC exploit pattern. ↗
→Monitor for multipart/form-data file uploads (field name 'data') to /incoming/ paths on router management interfaces, particularly uploading .bin or .cfg files without prior authentication. ↗

·The PoC URL contains a typo ('192.1680.1') but the intended target is the default gateway 192.168.0.1 — detection rules should match both the canonical IP and account for the typo in the published PoC. ↗
·Two distinct unauthenticated POST endpoints are referenced across sources (/incoming/Firmware.cfg for firmware replacement and /incoming/RouterBakCfgUpload.cfg for config upload) — detection coverage should include both paths. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.