CVE-2019-19824

🗓️ 27 Jan 2020 17:03:58Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 316 Views🌐 WEB

CVE-2019-19824: TOTOLINK Realtek SDK routers allow command executio

Reporter	Title	Published	Views	Family All 14
zdt	Realtek SDK Information Disclosure / Code Execution Exploit	27 Jan 202000:00	–	zdt
ATTACKERKB	CVE-2019-19824	5 Nov 201900:00	–	attackerkb
Circl	CVE-2019-19824	14 Nov 202400:00	–	circl
Check Point Advisories	TOTOLINK Realtek SDK Routers Command Injection (CVE-2019-19824)	16 Nov 202000:00	–	checkpoint_advisories
Cvelist	CVE-2019-19824	27 Jan 202017:03	–	cvelist
Nuclei	TOTOLINK Realtek SD Routers - Remote Command Injection	26 Aug 202602:49	–	nuclei
NVD	CVE-2019-19824	27 Jan 202018:15	–	nvd
OSV	CVE-2019-19824	27 Jan 202018:15	–	osv
Packet Storm	Realtek SDK Information Disclosure / Code Execution	24 Jan 202000:00	–	packetstorm
Prion	Design/Logic Flaw	27 Jan 202018:15	–	prion

NVD

Vulnrichment

Node

AND

totolink a3002ru_firmwareRange≤2.0.0

totolink a3002ruMatch-

Node

AND

totolink a702r_firmwareRange≤2.1.3

totolink a702rMatch-

Node

AND

totolink n301rt_firmwareRange≤2.1.6

totolink n301rtMatch-

Node

AND

totolink n302r_firmwareRange≤3.4.0

totolink n302rMatch-

Node

AND

totolink n300rt_firmwareRange≤3.4.0

totolink n300rtMatch-

Node

AND

totolink n200re_firmwareRange≤4.0.0

totolink n200reMatch-

Node

AND

totolink n150rt_firmwareRange≤3.4.0

totolink n150rtMatch-

Node

AND

totolink n100re_firmwareRange≤3.4.0

totolink n100reMatch-

Source	Link
github	www.github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
packetstormsecurity	www.packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
sploit	www.sploit.tech/
seclists	www.seclists.org/fulldisclosure/2020/Jan/38
seclists	www.seclists.org/fulldisclosure/2020/Jan/36

Parameter	Position	Path	Description	CWE
submit-url	request body	boafrm/formSysCmd	Authenticated attacker can execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI.	CWE-78
sysCmdselect	request body	boafrm/formSysCmd	Authenticated attacker can execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI.	CWE-78
sysCmdselects	request body	boafrm/formSysCmd	Authenticated attacker can execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI.	CWE-78
save_apply	request body	boafrm/formSysCmd	Authenticated attacker can execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI.	CWE-78
sysCmd	request body	boafrm/formSysCmd	Authenticated attacker can execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI.	CWE-78
topicurl	request body	boafrm/formLogin	Captcha protection may be bypassed; attacker can obtain captcha/plain text or act without captcha using HTTP Basic in header.	CWE-804

17 Jun 2026 02:27Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

CVSS 29

EPSS0.25135

SSVC