CVE-2019-19822

published 2020-01-27

CVE-2019-19822: A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration…

Priority P2 60 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
ciktel	mesh_router_firmware	<= 2019-12-12	—
coship	emta_ap_firmwre	<= 2019-12-12	—
fg-products	fgn-r2_firmware	<= 2019-12-12	—
hcn_max-c300n_project	hcn_max-c300n_firmware	<= 2019-12-12	—
hiwifi	max-c300n_firmware	<= 2019-12-12	—
iodata	wn-ac1167r_firmwre	<= 2019-12-12	—
kctvjeju	wireless_ap_firmware	<= 2019-12-12	—
realtek	rtk_11n_ap_firmware	<= 2019-12-12	—
sapido	gr297n_firmware	<= 2019-12-12	—
tbroad	gn-866ac_firmware	<= 2019-12-12	—
totolink	a3002ru_firmware	<= 2.0.0	—
totolink	a702r_firmware	<= 2.1.3	—
totolink	n100re_firmware	<= 3.4.0	—
totolink	n150rt_firmware	<= 3.4.0	—
totolink	n200re_firmware	<= 4.0.0	—
totolink	n300rt_firmware	<= 3.4.0	—
totolink	n301rt_firmware	<= 2.1.6	—
totolink	n302r_firmware	<= 3.4.0	—

Detection & IOCs extracted from sources · hover to see the quote

path /config.dat↗

url {{BaseURL}}/config.dat

other content_type: text/plain

other server: boa

version Boa 0.94.14rc21↗

• → Send an unauthenticated HTTP GET request to /config.dat on the target router; a 200 response with Content-Type: text/plain, a Server header containing 'boa', and Accept-Ranges: bytes indicates a vulnerable device exposing its full configuration.
• → The vulnerable administration interface is identifiable via the FOFA query title="totolink"; devices running Boa 0.94.14rc21 with Realtek APMIB 0.11f are affected.

• · The vulnerability is unauthenticated (CWE-306 — Missing Authentication for Critical Function); no credentials are required to retrieve config.dat, which contains Wi-Fi passwords, admin credentials, and network settings. ↗
• · Affected firmware versions span multiple vendors and models beyond TOTOLINK, including Rutek, Sapido, CIK TELECOM, KCTVJEJU, Fibergate, Hi-Wifi, HCN, T-broad, Coship, and IO-Data devices — all sharing the Realtek SDK stack. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306