PT-2020-10247 · Totolink · Totolink N301Rt+7

Br0X · Published 2020-01-27 · Updated 2024-09-21 · CVE-2019-19824

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU versions 2.0.0 and earlier TOTOLINK A702R versions 2.1.3 and earlier TOTOLINK N301RT versions 2.1.6 and earlier TOTOLINK N302R versions 3.4.0 and earlier TOTOLINK N300RT versions 3.4.0 and earlier TOTOLINK N200RE versions 4.0.0 and earlier TOTOLINK N150RT versions 3.4.0 and earlier TOTOLINK N100RE versions 3.4.0 and earlier TOTOLINK N302RE version 2.0.2

Description An authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the "boafrm/formSysCmd" URI. This allows for full control over the device's internals.

Recommendations For TOTOLINK A3002RU versions 2.0.0 and earlier, consider disabling access to the "boafrm/formSysCmd" URI until a patch is available. For TOTOLINK A702R versions 2.1.3 and earlier, restrict the use of the sysCmd parameter in the "boafrm/formSysCmd" URI to minimize the risk of exploitation. For TOTOLINK N301RT versions 2.1.6 and earlier, avoid using the sysCmd parameter in the affected API endpoint until the issue is resolved. For TOTOLINK N302R versions 3.4.0 and earlier, temporarily disable the sysCmd functionality to prevent exploitation. For TOTOLINK N300RT versions 3.4.0 and earlier, restrict access to the vulnerable module to minimize the risk of exploitation. For TOTOLINK N200RE versions 4.0.0 and earlier, consider disabling the sysCmd parameter in the "boafrm/formSysCmd" URI as a temporary workaround. For TOTOLINK N150RT versions 3.4.0 and earlier, avoid using the vulnerable API endpoint until a patch is available. For TOTOLINK N100RE versions 3.4.0 and earlier, restrict the use of the sysCmd parameter to prevent exploitation. For TOTOLINK N302RE version 2.0.2, consider disabling access to the "boafrm/formSysCmd" URI until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-19824

Affected Products

Totolink A3002Ru

Totolink A702R

Totolink N100Re

Totolink N150Rt

Totolink N200Re

Totolink N300Rt

Totolink N301Rt

Totolink N302R

References · 9

• 🔥 http://seclists.org/fulldisclosure/2020/Jan/38 · Exploit
• 🔥 https://sploit.tech/2019/12/16/Realtek-TOTOLINK.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Jan/36 · Exploit
• 🔥 https://sploit.tech · Exploit
• 🔥 http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19824 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19824 · Vendor Advisory
• https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities · Note
• https://twitter.com/rst_cloud/status/1837592713266364853 · Twitter Post