Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-19825 — Improper Authentication in A3002ru Firmware

CWE-287 — Improper Authentication5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
28.8%
top 3.45%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Totolink A3002ru FirmwareTotolink A702r FirmwareTotolink N100re Firmware+5 more
Timeline
PublishedJan 27
Latest updateMay 24

Description

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages8 packages

🔴Vulnerability Details

3
GHSA
GHSA-qx9v-3w62-8wqf: On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin↗2022-05-24
▶
CVEList
CVE-2019-19825: On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin↗2020-01-27
▶
VulnCheck
totolink a3002ru Improper Authentication↗2019
▶

💥Exploits & PoCs

1
Nuclei
TOTOLINK/Realtek Routers - CAPTCHA Bypass
▶