Command Injection Vulnerability in TOTOLINK Realtek SDK Routers
CVE-2019-19824

8.8HIGH

Key Information:

Vendor
Totolink
Status
A3002ru Firmware
Vendor
CVE Published:
27 January 2020

Summary

A command injection vulnerability exists in certain models of TOTOLINK routers powered by the Realtek SDK. An attacker with authentication can exploit this flaw by sending crafted requests to the device's sysCmd parameter via the boafrm/formSysCmd URI. This vulnerability provides the potential for the attacker to execute arbitrary operating system commands, granting them complete control over the router's internal systems, even if the graphical user interface for command execution is not accessible.

References

https://sploit.tech
http://seclists.org/fulldisclosure/2020/Jan/36
mailing-list
http://packetstormsecurity.com/files/156083/Realtek-SDK-I...

EPSS Score

75% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.