CriticalPublic exploit

CAPTCHA Bypass in TOTOLINK Realtek SDK-based Routers

IdentifiersCVE-2019-19825CWE-200

CVE-2019-19825 affects certain TOTOLINK routers built on the Realtek SDK. The login CAPTCHA can be defeated because the CAPTCHA text is retrievable directly by sending a POST request with {"topicurl":"setting/getSanvas"} to the boafrm/formLogin endpoint. This exposes the server-side CAPTCHA value to an unauthenticated requester, defeating the intended anti-automation control. The issue affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0. The provided information also indicates that once valid credentials are known, CAPTCHA is unnecessary because router actions can be performed directly over HTTP using Basic Authentication.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

The primary impact is bypass of the CAPTCHA protection on the administrative login flow, enabling automated credential attacks and reducing friction for brute-force or credential-stuffing attempts against affected routers. In addition, because administrative actions can be performed via HTTP requests using Basic Authentication once valid credentials are known, the CAPTCHA does not meaningfully protect management functionality. Successful exploitation can therefore facilitate unauthorized administrative access when credentials are obtained, allowing an attacker to change router settings and otherwise operate the device through the management interface.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the router management interface to trusted networks only, disable remote administration if not required, and place the administrative interface behind network-layer controls such as ACLs or VPN access. Use strong unique administrator credentials to reduce the value of CAPTCHA bypass for brute-force attacks. Monitor for repeated authentication attempts and unexpected configuration changes. Because Basic Authentication can be used for router actions once credentials are known, ensure management traffic is not exposed to untrusted networks.

Remediation

Patch, then assume compromise.

Upgrade affected TOTOLINK firmware to a version that no longer exposes the CAPTCHA value through boafrm/formLogin and that properly enforces CAPTCHA validation server-side without disclosing the answer. If vendor-fixed firmware is unavailable, replace affected devices or move administration to a more secure platform. Review and harden authentication controls, including changing default or weak administrative passwords.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TotolinkA3002ru Firmwareoperating_system

TotolinkA702r Firmwareoperating_system

TotolinkN100re Firmwareoperating_system

TotolinkN150rt Firmwareoperating_system

TotolinkN200re Firmwareoperating_system

TotolinkN300rt Firmwareoperating_system

TotolinkN301rt Firmwareoperating_system

TotolinkN302r Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2019-19825

NVD

nvd.nist.gov/vuln/detail/CVE-2019-19825

MITRE CWE · CWE-200

cwe.mitre.org

Third Party Advisory

packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html

Third Party Advisory

seclists.org/fulldisclosure/2020/Jan/36

Third Party Advisory

seclists.org/fulldisclosure/2020/Jan/38

Third Party Advisory

sploit.tech

CAPTCHA Bypass in TOTOLINK Realtek SDK-based Routers

IdentifiersCVE-2019-19825CWE-200