peter bassill · operator
$ cve CVE-2019-19825 JSON

CVE-2019-19825

9.8
CRITICAL · CVSS 3.1 · EPSS 29.6% (pctl 98)

Patch early

EPSS 29.6% — above the 10% action threshold.

Description

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS29.56% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-287
On CISA KEVno
Public exploitnone known
Published2020-01-27
Last modified2026-06-17

Affected (16)

VendorProduct
totolinka3002ru
totolinka3002ru firmware
totolinka702r
totolinka702r firmware
totolinkn100re
totolinkn100re firmware
totolinkn150rt
totolinkn150rt firmware
totolinkn200re
totolinkn200re firmware
totolinkn300rt
totolinkn300rt firmware
totolinkn301rt
totolinkn301rt firmware
totolinkn302r
totolinkn302r firmware

References

→ the Explorer  ·  watch your stack  ·  NVD