CVE-2019-19824

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
totolink	a3002ru_firmware	<= 2.0.0
totolink	a702r_firmware	<= 2.1.3
totolink	n301rt_firmware	<= 2.1.6
totolink	n302r_firmware	<= 3.4.0
totolink	n200re_firmware	<= 4.0.0
totolink	n150rt_firmware	<= 3.4.0
totolink	n100re_firmware	<= 3.4.0
totolink	n302re_firmware	< 2.0.2

References

http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38Exploit, Mailing List, Third Party Advisory
https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
https://sploit.techExploit, Third Party Advisory
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38Exploit, Mailing List, Third Party Advisory
https://sploit.techExploit, Third Party Advisory

Timeline

Published: Jan 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-198259.8On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/CVE-2019-198269.8The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_CVE-2019-198295.4A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability t CVE-2019-19835.3A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content CVE-2019-198306.5_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.CVE-2019-198328.8Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The f CVE-2019-198336.5In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieve CVE-2019-198347.2Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via en CVE-2019-198357.5SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server a CVE-2019-198369.8AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses CVE-2019-198375.3Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of b CVE-2019-198389.8emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu