CVE-2019-19825
First published: Mon Jan 27 2020(Updated: )
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TOTOLINK A3002RU | <=2.0.0 | |
| TOTOLINK A3002R | ||
| Totolink A702R | <=2.1.3 | |
| Totolink A702R-v2 | ||
| Totolink N301rt Firmware | <=2.1.6 | |
| Totolink N301rt Firmware | ||
| Totolink N302r Plus | <=3.4.0 | |
| Totolink N302R | ||
| Totolink N300RT | <=3.4.0 | |
| Totolink N300RT Firmware | ||
| Totolink N200RE-v3 Firmware | <=4.0.0 | |
| Totolink N200re Firmware | ||
| Totolink N150rt | <=3.4.0 | |
| Totolink N150rt Firmware | ||
| Totolink N100RE Firmware | <=3.4.0 | |
| Totolink N100RE Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-19825?
CVE-2019-19825 is a vulnerability that allows the retrieval of CAPTCHA text on certain TOTOLINK Realtek SDK based routers, leading to a CAPTCHA bypass.
How severe is CVE-2019-19825?
CVE-2019-19825 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2019-19825?
The Totolink A3002ru Firmware version 2.0.0 and Totolink A702r Firmware version 2.1.3 are affected by CVE-2019-19825.
How can I fix CVE-2019-19825?
There is currently no known fix for CVE-2019-19825. It is recommended to disable the affected routers or use an alternative solution.
Where can I find more information about CVE-2019-19825?
You can find more information about CVE-2019-19825 on the following references: [Link 1](http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html), [Link 2](http://seclists.org/fulldisclosure/2020/Jan/36), [Link 3](http://seclists.org/fulldisclosure/2020/Jan/38).
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/totolink
- canonical/totolink a3002ru
- version/totolink a3002ru/2.0.0
- canonical/totolink a3002r
- canonical/totolink a702r
- version/totolink a702r/2.1.3
- canonical/totolink a702r-v2
- canonical/totolink n301rt firmware
- version/totolink n301rt firmware/2.1.6
- canonical/totolink n302r plus
- version/totolink n302r plus/3.4.0
- canonical/totolink n302r
- canonical/totolink n300rt
- version/totolink n300rt/3.4.0
- canonical/totolink n300rt firmware
- canonical/totolink n200re-v3 firmware
- version/totolink n200re-v3 firmware/4.0.0
- canonical/totolink n200re firmware
- canonical/totolink n150rt
- version/totolink n150rt/3.4.0
- canonical/totolink n150rt firmware
- canonical/totolink n100re firmware
- version/totolink n100re firmware/3.4.0