CVE-2019-19825: totolink a3002ru_firmware Improper Authentication

Vulnerability summary

CVE-2019-19825 is a critical (CVSS 9.8) Improper Authentication vulnerability in totolink a3002ru_firmware. EPSS estimates a 29.56% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-01-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.