9.8

CVE-2019-19825

Exploit
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Totolink ≫ A3002ru Firmware Version <= 2.0.0
   Totolink ≫ A3002ru Version -
Totolink ≫ A702r Firmware Version <= 2.1.3
   Totolink ≫ A702r Version -
Totolink ≫ N301rt Firmware Version <= 2.1.6
   Totolink ≫ N301rt Version -
Totolink ≫ N302r Firmware Version <= 3.4.0
   Totolink ≫ N302r Version -
Totolink ≫ N300rt Firmware Version <= 3.4.0
   Totolink ≫ N300rt Version -
Totolink ≫ N200re Firmware Version <= 4.0.0
   Totolink ≫ N200re Version -
Totolink ≫ N150rt Firmware Version <= 3.4.0
   Totolink ≫ N150rt Version -
Totolink ≫ N100re Firmware Version <= 3.4.0
   Totolink ≫ N100re Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 29.56% 0.979
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2020/Jan/38
Third Party Advisory
Mailing List
https://sploit.tech
Third Party Advisory
Exploit