Read the docs
TI-2019-13967 Aliases CVE-2019-19356GHSA-ch88-rxpc-5c5r

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through…

Priority CRITICAL 92Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.28075 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:netis-systems:wf2419_firmware:1.2.31805:*:*:*:*:*:*:*1.2.31805VulnerableNetis
cpe:2.3:o:netis-systems:wf2419_firmware:2.2.36123:*:*:*:*:*:*:*2.2.36123VulnerableNetis
cpe:2.3:h:netis-systems:wf2419:-:*:*:*:*:*:*:*not specified by NVDRunning onNetis
  • cpe:2.3:o:netis-systems:wf2419_firmware:1.2.31805:*:*:*:*:*:*:* Versions 1.2.31805 Vulnerable ·Netis
  • cpe:2.3:o:netis-systems:wf2419_firmware:2.2.36123:*:*:*:*:*:*:* Versions 2.2.36123 Vulnerable ·Netis
  • cpe:2.3:h:netis-systems:wf2419:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Netis

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2019-19356
  3. 2026-10-03 Alias added: GHSA-ch88-rxpc-5c5r

References

Exploit 3

  • TI-2018-04707 A cross-site request forgery web vulnerability has been discovered on Netis WF2419… CVSS 3.0HIGH 8.8
  • TI-2018-04548 Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page. CVSS 3.0MEDIUM 5.4
  • TI-2018-04336 Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page. CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences