PT-2019-6112 · Netis · Netis Wf2419

Published 2019-05-10 · Updated 2025-04-03 · CVE-2019-19356

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netis WF2419 versions V1.2.31805 through V2.2.36123

Description The vulnerability is related to the implementation of the ping and tracert commands in the web interface of the Netis WF2419 router's firmware, which fails to neutralize special elements. This allows a remote attacker to execute arbitrary commands and gain unauthorized access to protected information by sending specially crafted HTTP requests. The issue is due to a lack of user input sanitizing, enabling the execution of system commands as root through the tracert diagnostic tool.

Recommendations For versions V1.2.31805 and V2.2.36123, consider disabling the tracert diagnostic tool in the web management page as a temporary workaround to minimize the risk of exploitation. Restrict access to the router's web management page to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-05698

CVE-2019-19356

Affected Products

Netis Wf2419

References · 10

• 🔥 https://github.com/shadowgatt/CVE-2019-19356 · Exploit
• 🔥 https://digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356 · Exploit
• 🔥 http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-19356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19356 · Security Note
• https://bdu.fstec.ru/vul/2021-05698 · Security Note
• https://t.me/aptreports/5860 · Telegram Post
• https://t.me/cvenotify/117660 · Telegram Post
• https://t.me/aptreports/5862 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19356 · Note