← Vulnerability feed

Vulnerability record · CVE-2019-19825 · published 27 January 2020

CVE-2019-19825: Totolink a3002ru firmware improper authentication vulnerability

TTotolink · A3002ru Firmware

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

9.8 CVSS 3.1 Critical EPSS 30% · top 1.9% CWE-287 · Improper authentication
9.8CVSS 3.1 base score, v2 7.5
30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
8Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38 Mailing ListThird Party Advisory
https://sploit.tech ExploitThird Party Advisory
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jan/36 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/38 Mailing ListThird Party Advisory
https://sploit.tech ExploitThird Party Advisory

Track CVE-2019-19825 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-34198Totolink a3002ru firmware classic buffer overflow vulnerabilityTOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fail…EPSS 0.66%9.8CVE-2024-1001Totolink n200re firmware stack-based buffer overflow vulnerabilityA vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cs…EPSS 1.4%9.8CVE-2024-0299Totolink n200re firmware os command injection vulnerabilityA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function …EPSS 3.8%9.8CVE-2024-0297Totolink n200re firmware os command injection vulnerabilityA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of …EPSS 3.8%9.8CVE-2024-0298Totolink n200re firmware os command injection vulnerabilityA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of t…EPSS 3.8%9.8CVE-2024-0296Totolink n200re firmware os command injection vulnerabilityA vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWi…EPSS 3.8%9.8CVE-2022-35491Totolink a3002ru firmware hard-coded credentials vulnerabilityTOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample.EPSS 0.82%9.8CVE-2018-13306Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.EPSS 3.2%

Source: NIST National Vulnerability Database (record CVE-2019-19825), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.