CVE-2019-19824 - On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available

Back Back to CVE browser

HIGH

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available

Published Jan 27, 2020

8.8

HIGH

CVSS 3.1

EPSS 25.14%

Description

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Affected products

Vendor TOTOLINK Product A3002ru Firmware Default
unknown
Affected
- ≥ 0, ≤ 2.0.0
Vendor TOTOLINK Product A702r Firmware Default
unknown
Affected
- ≥ 0, ≤ 2.1.3
Vendor TOTOLINK Product N100re Firmware Default
unknown
Affected
- ≥ 0, ≤ 3.4.0
Vendor TOTOLINK Product N150rt Firmware Default
unknown
Affected
- ≥ 0, ≤ 3.4.0
Vendor TOTOLINK Product N200re Firmware Default
unknown
Affected
- ≥ 0, ≤ 4.0.0
Vendor TOTOLINK Product N301rt Firmware Default
unknown
Affected
- ≥ 0, ≤ 2.1.6
Vendor TOTOLINK Product N302r Firmware Default
unknown
Affected
- ≥ 0, ≤ 3.4.0
Vendor TOTOLINK Product N302re Firmware Default
unknown
Affected
- ≥ 0, < 2.0.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
TOTOLINK	A3002ru Firmware	unknown	Affected ≥ 0, ≤ 2.0.0
TOTOLINK	A702r Firmware	unknown	Affected ≥ 0, ≤ 2.1.3
TOTOLINK	N100re Firmware	unknown	Affected ≥ 0, ≤ 3.4.0
TOTOLINK	N150rt Firmware	unknown	Affected ≥ 0, ≤ 3.4.0
TOTOLINK	N200re Firmware	unknown	Affected ≥ 0, ≤ 4.0.0
TOTOLINK	N301rt Firmware	unknown	Affected ≥ 0, ≤ 2.1.6
TOTOLINK	N302r Firmware	unknown	Affected ≥ 0, ≤ 3.4.0
TOTOLINK	N302re Firmware	unknown	Affected ≥ 0, < 2.0.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (6)

http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36
mailing-listExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38
mailing-listExploitMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9422
Advisory
https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
https://sploit.tech
ExploitThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html		ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36		mailing-listExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38		mailing-listExploitMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9422		Advisory
https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
https://sploit.tech		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 27, 2020

Updated Aug 28, 2024

Reserved Dec 16, 2019

Link CVE-2019-19824

CISA Vulnrichment

Updated Aug 28, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-19824

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jan 27, 2020

Updated Aug 28, 2024

Link EUVD-2019-9422

GitHub

No data