CVE-2019-19356: Netis WF2419 Devices Remote Code Execution Vulnerability

Vulnerability summary

CVE-2019-19356 is a high (CVSS 8.5) vulnerability in Netis WF2419 Devices. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 28.07% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 07-02-2020
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVExploitedNetis WF2419 Devices Remote Code Execution Vulnerability
3. 03-05-2022
   CISA remediation dueDeadline passedApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.