Read the docs
TI-2019-14287 Aliases CVE-2019-19822GHSA-552g-mhvj-f64v

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa…

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

Why it matters now

EPSS 0.08669 95th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*up to 2.0.0VulnerableTOTOLINK
cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*up to 2.1.3VulnerableTOTOLINK
cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*up to 4.0.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:* Versions up to 2.1.3 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:* Versions up to 4.0.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableRealtek
cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onRealtek
cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableSapido
cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:*not specified by NVDRunning onSapido
cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableCiktel
cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:*not specified by NVDRunning onCiktel
cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableKctvjeju
cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onKctvjeju
cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableFg-products
cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:*not specified by NVDRunning onFg-products
cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableHiwifi
cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:*not specified by NVDRunning onHiwifi
cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableTbroad
cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:*not specified by NVDRunning onTbroad
cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableCoship
cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onCoship
cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableIodata
cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:*not specified by NVDRunning onIodata
cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableHcn Max-c300n Project
cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:*not specified by NVDRunning onHcn Max-c300n Project
cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*up to 2.1.6VulnerableTOTOLINK
cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Realtek
  • cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Realtek
  • cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Sapido
  • cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sapido
  • cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Ciktel
  • cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ciktel
  • cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Kctvjeju
  • cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Kctvjeju
  • cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Fg-products
  • cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fg-products
  • cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Hiwifi
  • cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hiwifi
  • cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Tbroad
  • cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Tbroad
  • cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Coship
  • cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Coship
  • cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Iodata
  • cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
  • cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Hcn Max-c300n Project
  • cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hcn Max-c300n Project
  • cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:* Versions up to 2.1.6 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19822
  2. 2026-10-03 Alias added: GHSA-552g-mhvj-f64v
  3. 2026-10-08 EPSS moved to the 95th–99th percentile

References

Exploit 3

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences