CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

VulnCheck KEV: CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can...

TOTOLINK Realtek SDK Routers Authentication Bypass (CVE-2019-19825)

An authentication bypass vulnerability exists in TOTOLINK Realtek SDK Routers. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

CVE-2019-19825

creationtimestamp| type| source ---|---|--- 2020-01-27 21:37:53+00:00| seen| https://t.me/cveNotify/459 2024-11-24 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-24 2024-12-14 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities -...

CVE-2019-19825

Summary of CVE-2019-19825 (Realtek SDK / TOTOLINK routers) Authenticated CAPTCHA bypass vulnerability affecting Realtek SDK-based routers (TOTOLINK and others) via a POST to boafrm/formLogin with payload {"topicurl":"setting/getSanvas"}. The CAPTCHA text can be retrieved without authentication, e...