CVE-2019-19824 (GCVE-0-2019-19824)
Vulnerability from cvelistv5 – Published: 2020-01-27 17:03 – Updated: 2024-08-28 18:03Summary
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.
Severity
No CVSS data available.
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-28 17:53 UTC
CWE
- n/a
Assigner
References
Impacted products
8 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| totolink | a3002ru_firmware |
Affected:
0 , ≤ 2.0.0
(custom)
cpe:2.3:o:totolink:a3002ru_firmware:-:*:*:*:*:*:*:* |
||
| totolink | a702r_firmware |
Affected:
0 , ≤ 2.1.3
(custom)
cpe:2.3:o:totolink:a702r_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n301rt_firmware |
Affected:
0 , ≤ 2.1.6
(custom)
cpe:2.3:o:totolink:n301rt_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n302r_firmware |
Affected:
0 , ≤ 3.4.0
(custom)
cpe:2.3:o:totolink:n302r_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n200re_firmware |
Affected:
0 , ≤ 4.0.0
(custom)
cpe:2.3:o:totolink:n200re_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n150rt_firmware |
Affected:
0 , ≤ 3.4.0
(custom)
cpe:2.3:o:totolink:n150rt_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n100re_firmware |
Affected:
0 , ≤ 3.4.0
(custom)
cpe:2.3:o:totolink:n100re_firmware:-:*:*:*:*:*:*:* |
||
| totolink | n302re_firmware |
Affected:
0 , < 2.0.2
(custom)
cpe:2.3:o:totolink:n302re_firmware:*:*:*:*:*:*:*:* |
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: a52b2fba-9127-40cc-8771-4607bc93d4fe
Exploited: Yes
Characteristics
Severity:
88.0
Timestamps
First Seen: 2023-10-14
Asserted: 2023-10-14
Last Seen: 2026-07-20
Scope
Asset Exposure: ['internet-facing']
Notes: Affected: Totolink / TOTOLINK Realtek SDK based routers | Class: router | Severity: High (CVSS 8.8) | IoT: yes | In CISA KEV: no | Honeypot connections on 2026-07-20: 4
Evidence
Type: Honeypot
Signal: In The Wild Attempts
Confidence: 70%
Source: shadowserver
Details
| 1D | 1 |
|---|---|
| Iot | yes |
| Feed | Shadowserver Foundation honeypot/exploited-vulnerabilities |
| Type | http-scan |
| Class | router |
| 7D Avg | 0 |
| Vendor | Totolink |
| 30D Avg | 2 |
| 90D Avg | 3 |
| Product | TOTOLINK Realtek SDK based routers |
| Cisa Kev | no |
| Connections | 4 |
| Observation Date | 2026-07-20 |
| Vulnerability Class | CVSS |
| Vulnerability Score | 8.8 |
| Vulnerability Severity | High |
References
Created: 2026-06-30 09:22 UTC
| Updated: 2026-07-22 01:01 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 04acf2e0-c4eb-43e3-933f-89a2f38cdcc7
Exploited: Yes
Timestamps
First Seen: 2025-04-25
Asserted: 2025-04-25
Scope
Notes: KEVIntel entry: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the... | Affected: TOTOLINK / Realtek SDK based routers | CVSS: 8.8 (HIGH) | Used in malware: unknown | Not yet in CISA KEV: True
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the... |
| Vendor | TOTOLINK |
| Product | Realtek SDK based routers |
| Added Date | 2025-04-25T00:00:00.000Z |
| Cvss Score | 8.8 |
| Epss Score | None |
| Cvss Severity | HIGH |
| Epss Percentile | None |
| Used In Malware | unknown |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | True |
References
Created: 2026-06-23 14:04 UTC
| Updated: 2026-07-10 06:14 UTC
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:25:12.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sploit.tech"
},
{
"name": "20200124 Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2020/Jan/36"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html"
},
{
"name": "20200131 Re: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2020/Jan/38"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:a3002ru_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a3002ru_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:a702r_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a702r_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "2.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n301rt_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n301rt_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n302r_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n302r_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "3.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n200re_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n200re_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "4.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n150rt_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n150rt_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "3.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n100re_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n100re_firmware",
"vendor": "totolink",
"versions": [
{
"lessThanOrEqual": "3.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:totolink:n302re_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n302re_firmware",
"vendor": "totolink",
"versions": [
{
"lessThan": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-19824",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T17:53:16.850487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T18:03:26.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device\u0027s internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T15:15:03.364Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://sploit.tech"
},
{
"name": "20200124 Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2020/Jan/36"
},
{
"url": "http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html"
},
{
"name": "20200131 Re: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2020/Jan/38"
},
{
"url": "https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-19824",
"datePublished": "2020-01-27T17:03:58.000Z",
"dateReserved": "2019-12-16T00:00:00.000Z",
"dateUpdated": "2024-08-28T18:03:26.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-19824",
"date": "2026-09-16",
"epss": "0.25135",
"percentile": "0.97819"
},
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.0.0\", \"matchCriteriaId\": \"87EC51C9-338B-4E98-8455-069319320802\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"21945D3C-27AA-4614-8D5D-C22DE8C56F94\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.1.3\", \"matchCriteriaId\": \"28C67D43-7914-4AF3-9DF8-E1BF41F1AC89\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49D3C58B-4632-464E-A0A6-33807E9A1842\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.1.6\", \"matchCriteriaId\": \"87A0ECEA-3FA7-4ADF-ACFA-6C4B93373DA3\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE1ED560-8B9F-40D2-AD91-6D5D4290ED79\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.4.0\", \"matchCriteriaId\": \"71A22EA9-F5A5-4789-96F4-3C8600BC4848\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0E1D2C0-02F5-4933-9DEB-89F711052D69\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.4.0\", \"matchCriteriaId\": \"7E826FD1-C8F6-4301-972F-1B3949F59275\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0581174-E6B1-4E3D-8384-7852EC53FC14\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.0.0\", \"matchCriteriaId\": \"47025B3A-648B-4F89-AEA0-C76B348CBAFB\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9FF7FF59-DB13-4FEA-A81C-124048BF1676\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.4.0\", \"matchCriteriaId\": \"E096F9E2-08E5-4B44-A83A-FB659D898DB5\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7525BE05-F394-4ED7-B7A6-F9005EDE90D7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.4.0\", \"matchCriteriaId\": \"635C33EA-BEF1-4C7E-8E3A-5ED5DF79358D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"30CA1251-C9EA-498E-9AD4-627CA9B1A007\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device\u0027s internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.\"}, {\"lang\": \"es\", \"value\": \"En determinados enrutadores basados ??en TOTOLINK Realtek SDK, un atacante autenticado puede ejecutar comandos arbitrarios de Sistema Operativo por medio del par\\u00e1metro sysCmd en el URI boafrm/formSysCmd, inclusive si la GUI (syscmd.htm) no est\\u00e1 disponible. Esto permite un control total sobre los internos del dispositivo. Esto afecta a A3002RU versiones hasta 2.0.0, A702R versiones hasta 2.1.3, N301RT versiones hasta 2.1.6, N302R versiones hasta 3.4.0, N300RT versiones hasta 3.4.0, N200RE versiones hasta 4.0.0, N150RT versiones hasta 3.4.0 y N100RE versiones hasta 3.4.0.\"}]",
"id": "CVE-2019-19824",
"lastModified": "2024-11-21T04:35:28.233",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:C/A:C\", \"baseScore\": 9.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-01-27T18:15:12.960",
"references": "[{\"url\": \"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/36\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/38\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://sploit.tech\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/36\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/38\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://sploit.tech\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-19824\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-01-27T18:15:12.960\",\"lastModified\":\"2024-11-21T04:35:28.233\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device\u0027s internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.\"},{\"lang\":\"es\",\"value\":\"En determinados enrutadores basados ??en TOTOLINK Realtek SDK, un atacante autenticado puede ejecutar comandos arbitrarios de Sistema Operativo por medio del par\u00e1metro sysCmd en el URI boafrm/formSysCmd, inclusive si la GUI (syscmd.htm) no est\u00e1 disponible. Esto permite un control total sobre los internos del dispositivo. Esto afecta a A3002RU versiones hasta 2.0.0, A702R versiones hasta 2.1.3, N301RT versiones hasta 2.1.6, N302R versiones hasta 3.4.0, N300RT versiones hasta 3.4.0, N200RE versiones hasta 4.0.0, N150RT versiones hasta 3.4.0 y N100RE versiones hasta 3.4.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.0.0\",\"matchCriteriaId\":\"87EC51C9-338B-4E98-8455-069319320802\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21945D3C-27AA-4614-8D5D-C22DE8C56F94\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.1.3\",\"matchCriteriaId\":\"28C67D43-7914-4AF3-9DF8-E1BF41F1AC89\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49D3C58B-4632-464E-A0A6-33807E9A1842\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.1.6\",\"matchCriteriaId\":\"87A0ECEA-3FA7-4ADF-ACFA-6C4B93373DA3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE1ED560-8B9F-40D2-AD91-6D5D4290ED79\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.4.0\",\"matchCriteriaId\":\"71A22EA9-F5A5-4789-96F4-3C8600BC4848\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0E1D2C0-02F5-4933-9DEB-89F711052D69\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.4.0\",\"matchCriteriaId\":\"7E826FD1-C8F6-4301-972F-1B3949F59275\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0581174-E6B1-4E3D-8384-7852EC53FC14\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.0.0\",\"matchCriteriaId\":\"47025B3A-648B-4F89-AEA0-C76B348CBAFB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FF7FF59-DB13-4FEA-A81C-124048BF1676\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.4.0\",\"matchCriteriaId\":\"E096F9E2-08E5-4B44-A83A-FB659D898DB5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7525BE05-F394-4ED7-B7A6-F9005EDE90D7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.4.0\",\"matchCriteriaId\":\"635C33EA-BEF1-4C7E-8E3A-5ED5DF79358D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30CA1251-C9EA-498E-9AD4-627CA9B1A007\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Jan/36\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Jan/38\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://sploit.tech\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Jan/36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Jan/38\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://sploit.tech\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://sploit.tech\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/36\", \"name\": \"20200124 Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers\", \"tags\": [\"mailing-list\", \"x_refsource_FULLDISC\", \"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/38\", \"name\": \"20200131 Re: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers\", \"tags\": [\"mailing-list\", \"x_refsource_FULLDISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T02:25:12.740Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2019-19824\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T17:53:16.850487Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:totolink:a3002ru_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"a3002ru_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.0.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:a702r_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"a702r_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.1.3\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n301rt_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n301rt_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.1.6\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n302r_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n302r_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.4.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n200re_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n200re_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.0.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n150rt_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n150rt_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.4.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n100re_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n100re_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.4.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:totolink:n302re_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"totolink\", \"product\": \"n302re_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.0.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T18:00:11.719Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://sploit.tech\"}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/36\", \"name\": \"20200124 Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2020/Jan/38\", \"name\": \"20200131 Re: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device\u0027s internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2024-08-28T15:15:03.364Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2019-19824\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-28T18:03:26.209Z\", \"dateReserved\": \"2019-12-16T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2020-01-27T17:03:58.000Z\", \"assignerShortName\": \"mitre\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…