PT-2020-10248 · Totolink+1 · Totolink N301Rt+8

Blazej Adamczyk + 1 · Published 2020-01-27 · Updated 2020-02-05 · CVE-2019-19825

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU versions 2.0.0 and earlier TOTOLINK A702R versions 2.1.3 and earlier TOTOLINK N301RT versions 2.1.6 and earlier TOTOLINK N302R versions 3.4.0 and earlier TOTOLINK N300RT versions 3.4.0 and earlier TOTOLINK N200RE versions 4.0.0 and earlier TOTOLINK N150RT versions 3.4.0 and earlier TOTOLINK N100RE versions 3.4.0 and earlier

Description The issue allows an attacker to bypass the CAPTCHA protection on certain TOTOLINK Realtek SDK based routers. This can be achieved by sending a POST request to the "boafrm/formLogin" URI with a specific topicurl parameter set to "setting/getSanvas", which retrieves the CAPTCHA text. Once valid credentials are obtained, the attacker can perform router actions via HTTP requests using Basic Authentication.

Recommendations For TOTOLINK A3002RU versions 2.0.0 and earlier, update to a version later than 2.0.0. For TOTOLINK A702R versions 2.1.3 and earlier, update to a version later than 2.1.3. For TOTOLINK N301RT versions 2.1.6 and earlier, update to a version later than 2.1.6. For TOTOLINK N302R versions 3.4.0 and earlier, update to a version later than 3.4.0. For TOTOLINK N300RT versions 3.4.0 and earlier, update to a version later than 3.4.0. For TOTOLINK N200RE versions 4.0.0 and earlier, update to a version later than 4.0.0. For TOTOLINK N150RT versions 3.4.0 and earlier, update to a version later than 3.4.0. For TOTOLINK N100RE versions 3.4.0 and earlier, update to a version later than 3.4.0. As a temporary workaround, consider restricting access to the "boafrm/formLogin" URI and disabling Basic Authentication until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-19825

Affected Products

Realtek Sdk

Totolink A3002Ru

Totolink A702R

Totolink N100Re

Totolink N150Rt

Totolink N200Re

Totolink N300Rt

Totolink N301Rt

Totolink N302R

References · 7

• 🔥 https://sploit.tech · Exploit
• https://osv.dev/vulnerability/CVE-2019-19825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19825 · Security Note
• http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html · Note
• http://seclists.org/fulldisclosure/2020/Jan/38 · Note
• http://seclists.org/fulldisclosure/2020/Jan/36 · Note
• https://t.me/cvenotify/459 · Telegram Post