CVE-2019-19823: totolink a3002ru firmware +17 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2019-19823

CVSS 7.5 · High EPSS 6,4%

Kerentanan Insufficiently Protected Credentials pada totolink a3002ru firmware, totolink a702r firmware +16 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

Rincian

Terbit di NVD: 27 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-522: Insufficiently Protected Credentials
EPSS (30 hari): 6,4% peluang dieksploitasi; lebih tinggi dari 93,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
totolink	a3002ru firmware	Semua versi hingga 2.0.0
totolink	a702r firmware	Semua versi hingga 2.1.3
totolink	n302r firmware	Semua versi hingga 3.4.0
totolink	n300rt firmware	Semua versi hingga 3.4.0
totolink	n200re firmware	Semua versi hingga 4.0.0
totolink	n150rt firmware	Semua versi hingga 3.4.0
totolink	n100re firmware	Semua versi hingga 3.4.0
realtek	rtk 11n ap firmware	Semua versi hingga 2019-12-12
sapido	gr297n firmware	Semua versi hingga 2019-12-12
ciktel	mesh router firmware	Semua versi hingga 2019-12-12
kctvjeju	wireless ap firmware	Semua versi hingga 2019-12-12
fg-products	fgn-r2 firmware	Semua versi hingga 2019-12-12
hiwifi	max-c300n firmware	Semua versi hingga 2019-12-12
tbroad	gn-866ac firmware	Semua versi hingga 2019-12-12
coship	emta ap firmwre	Semua versi hingga 2019-12-12
iodata	wn-ac1167r firmwre	Semua versi hingga 2019-12-12
hcn max-c300n project	hcn max-c300n firmware	Semua versi hingga 2019-12-12
totolink	n301rt firmware	Semua versi hingga 2.1.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz exploit · advisory pihak ketiga
http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2020/Jan/36 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2020/Jan/38 exploit · mailing list · advisory pihak ketiga
https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h... advisory pihak ketiga
https://sploit.tech advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.