CVEvulnerability

CVE-2019-19823

7.5 HIGH Published 2020-01-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-522

Description

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

Affected configurations

• totolink a3002ru firmware (<= 2.0.0) • totolink a702r firmware (<= 2.1.3) • totolink n302r firmware (<= 3.4.0) • totolink n300rt firmware (<= 3.4.0) • totolink n200re firmware (<= 4.0.0) • totolink n150rt firmware (<= 3.4.0) • totolink n100re firmware (<= 3.4.0) • realtek rtk 11n ap firmware (<= 2019-12-12) • sapido gr297n firmware (<= 2019-12-12) • ciktel mesh router firmware (<= 2019-12-12) • kctvjeju wireless ap firmware (<= 2019-12-12) • fg-products fgn-r2 firmware (<= 2019-12-12) • hiwifi max-c300n firmware (<= 2019-12-12) • tbroad gn-866ac firmware (<= 2019-12-12) • coship emta ap firmwre (<= 2019-12-12) • iodata wn-ac1167r firmwre (<= 2019-12-12) • hcn max-c300n project hcn max-c300n firmware (<= 2019-12-12) • totolink n301rt firmware (<= 2.1.6)

Related

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References