CVE-2019-19824: OS Command Injection
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.
Other sources
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2019-19824.
What is the severity level of CVE-2019-19824?
The severity level of CVE-2019-19824 is critical with a severity value of 8.8.
Which TOTOLINK routers are affected by CVE-2019-19824?
The TOTOLINK routers affected by CVE-2019-19824 are A3002RU with firmware up to version 2.0.0, A702r with firmware up to version 2.1.3, N301rt with firmware up to version 2.1.6, N302r with firmware up to version 3.4.0, N300rt with firmware up to version 3.4.0, N200re with firmware up to version 4.0.0, N150rt with firmware up to version 3.4.0, and N100re with firmware up to version 3.4.0.
How does the vulnerability CVE-2019-19824 allow an attacker to execute arbitrary OS commands?
The vulnerability CVE-2019-19824 allows an authenticated attacker to execute arbitrary OS commands by using the sysCmd parameter to the boafrm/formSysCmd URI.
Are there any available fixes for CVE-2019-19824?
At the moment, there are no known fixes or patches available for CVE-2019-19824. It is advised to take measures such as implementing strong access controls and network segmentation to mitigate the risk.