CVE-2019-19356: Netis WF2419 router command injection in tracert tool allows root RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw yields root code execution, has public exploit references, and is in CISA's KEV catalog, though it requires authenticated access to the management interface.

What it is

Netis WF2419 firmware versions V1.2.31805 and V2.2.36123 fail to sanitize user input in the tracert diagnostic tool on the web management page, allowing OS command injection (CWE-78). An authenticated user can execute arbitrary system commands as root, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker with access to the management interface gains root-level command execution on the router, enabling full device compromise, traffic interception or redirection, and use of the device as a foothold into the network.

Attack surface

Reachable over the network via the router's web management page (CVSS vector AV:N); the attacker must be authenticated to that page (PR:L) and no user interaction is required (UI:N).

Exploitation

CISA added this to the KEV catalog on 2021-11-03 with a 2022-05-03 remediation due date, and multiple public references are tagged Exploit; EPSS 30-day probability is 0.28168 (98th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor's firmware update for WF2419; if no fixed firmware exists for the deployed version, replace the device or take it off untrusted networks.
• Restrict access to the router web management interface to a trusted management VLAN or specific administrative hosts.
• Change default administrative credentials and enforce strong, unique passwords to reduce the authenticated access this flaw requires.
• Disable remote/WAN-side management access to the web interface where the feature is not needed.
• Monitor vendor advisories for end-of-support status and plan replacement of unsupported units.

Detection

• Review router logs for unexpected or malformed requests to the tracert/diagnostic endpoints of the web management page.
• Alert on outbound connections or DNS lookups originating from the router itself that are not part of normal operations.
• Audit management-page authentication logs for logins from unusual source addresses or at unusual times.
• Check for unexpected configuration changes, new admin accounts, or altered DNS settings on WF2419 devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.