CVE-2019-19824

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd…

published January 27, 2020

CVSS

—

EPSS

25%

Percentile

97.9

In the wild

Unconfirmed

What it is

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.25135 · 97.9th percentile
Published: 2020-01-27T17:03Z

EPSS history

Timeline

27 JAN 17:03Z
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd…
cvelistv5