cbcvebase.
CVE-2019-19825
published 2020-01-27

CVE-2019-19825: On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI…

PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
29.56%
98.0th percentile
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

Affected

8 ranges
VendorProductVersion rangeFixed in
totolinka3002ru_firmware<= 2.0.0—
totolinka702r_firmware<= 2.1.3—
totolinkn100re_firmware<= 3.4.0—
totolinkn150rt_firmware<= 3.4.0—
totolinkn200re_firmware<= 4.0.0—
totolinkn300rt_firmware<= 3.4.0—
totolinkn301rt_firmware<= 2.1.6—
totolinkn302r_firmware<= 3.4.0—

Detection & IOCsextracted from sources · hover to see the quote

url/boafrm/formLogin↗
commandPOST /boafrm/formLogin HTTP/1.1 Content-Type: application/json {"topicurl":"setting/getSanvas"}↗
other{"topicurl":"setting/getSanvas"}↗
  • →Detect exploitation attempts by monitoring for POST requests to /boafrm/formLogin with a JSON body containing the key 'topicurl' and value 'setting/getSanvas'. ↗
  • →A successful CAPTCHA leak response will be exactly 4 bytes, status 200, content-type text/html, and body matching ^[A-Za-z0-9]{4}$ — use content_length == 4 and this regex as a response matcher. ↗
  • →After CAPTCHA bypass, watch for subsequent HTTP requests using Basic Authentication headers targeting TOTOLINK router admin endpoints, indicating credential-based device takeover. ↗
  • →Use FOFA query title="totolink" or Shodan query http.html:"TOTOLINK" to identify exposed vulnerable devices on the internet. ↗
  • ·Vulnerability is limited to TOTOLINK routers built on the Realtek SDK. Affected firmware versions are: A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0. ↗
  • ·The CAPTCHA bypass is only the first stage; the attacker still needs valid credentials (obtained via brute-force or other means) to fully control the device. The CAPTCHA is not required once credentials are known. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.