TOTOLINK/Realtek Routers - Information Disclosure

highseverity

7.5CVSS score

6.4%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.

Impact

Unauthenticated attackers can retrieve the entire router configuration including Wi-Fi passwords, admin credentials, and network settings, enabling complete network takeover.

Fix

Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.

How to confirm it

Send: GET {{BaseURL}}/config.dat
Positive when: contains(content_type, "text/plain") and contains(to_lower(server), "boa") and contains(accept_ranges, "bytes") and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-19823 -u <target>

The full check

id: CVE-2019-19823

info:
  name: TOTOLINK/Realtek Routers - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.
  impact: |
    Unauthenticated attackers can retrieve the entire router configuration including Wi-Fi passwords, admin credentials, and network settings, enabling complete network takeover.
  remediation: |
    Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
  reference:
    - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19822
  classification:
    cve-id: CVE-2019-19823
    epss-score: 0.06411
    epss-percentile: 0.93744
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-306
  metadata:
    verified: true
    max-requests: 1
    vendor: totolink
    fofa-query: title="totolink"
  tags: cve,cve2019,totolink,realtek,exposure,config,boa,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/config.dat"

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "text/plain")'
          - 'contains(to_lower(server), "boa")'
          - 'contains(accept_ranges, "bytes")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from