← Back

CVE-2019-19824

nvd nistnuclei
Published: Jan 27, 2020Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Affected (8)

Totolink
8 products
A3002ru Firmware
A702r Firmware
N301rt Firmware
N302r Firmware
N300rt Firmware
N200re Firmware
N150rt Firmware
N100re Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
A3002ru Firmware
Up to 2.0.0
Running on/withPlatform Versions
Totolink
A3002ru
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
A702r Firmware
Up to 2.1.3
Running on/withPlatform Versions
Totolink
A702r
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N301rt Firmware
Up to 2.1.6
Running on/withPlatform Versions
Totolink
N301rt
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N302r Firmware
Up to 3.4.0
Running on/withPlatform Versions
Totolink
N302r
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N300rt Firmware
Up to 3.4.0
Running on/withPlatform Versions
Totolink
N300rt
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N200re Firmware
Up to 4.0.0
Running on/withPlatform Versions
Totolink
N200re
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N150rt Firmware
Up to 3.4.0
Running on/withPlatform Versions
Totolink
N150rt
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N100re Firmware
Up to 3.4.0
Running on/withPlatform Versions
Totolink
N100re
All versions

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (9)

Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.