Read the docs
TI-2019-14288 Aliases CVE-2019-19823GHSA-vj2g-8grq-fccw

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa…

Priority MEDIUM 42CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

Why it matters now

EPSS 0.06411 93rd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*up to 2.0.0VulnerableTOTOLINK
cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*up to 2.1.3VulnerableTOTOLINK
cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*up to 4.0.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:* Versions up to 2.0.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:* Versions up to 2.1.3 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:* Versions up to 4.0.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*up to 3.4.0VulnerableTOTOLINK
cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableRealtek
cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onRealtek
cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableSapido
cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:*not specified by NVDRunning onSapido
cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableCiktel
cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:*not specified by NVDRunning onCiktel
cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableKctvjeju
cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onKctvjeju
cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableFg-products
cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:*not specified by NVDRunning onFg-products
cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableHiwifi
cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:*not specified by NVDRunning onHiwifi
cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableTbroad
cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:*not specified by NVDRunning onTbroad
cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableCoship
cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:*not specified by NVDRunning onCoship
cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableIodata
cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:*not specified by NVDRunning onIodata
cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:*up to 2019-12-12VulnerableHcn Max-c300n Project
cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:*not specified by NVDRunning onHcn Max-c300n Project
cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*up to 2.1.6VulnerableTOTOLINK
cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:* Versions up to 3.4.0 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK
  • cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Realtek
  • cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Realtek
  • cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Sapido
  • cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sapido
  • cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Ciktel
  • cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ciktel
  • cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Kctvjeju
  • cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Kctvjeju
  • cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Fg-products
  • cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fg-products
  • cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Hiwifi
  • cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hiwifi
  • cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Tbroad
  • cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Tbroad
  • cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Coship
  • cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Coship
  • cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Iodata
  • cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Iodata
  • cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:* Versions up to 2019-12-12 Vulnerable ·Hcn Max-c300n Project
  • cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hcn Max-c300n Project
  • cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:* Versions up to 2.1.6 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19823
  2. 2026-10-03 Alias added: GHSA-vj2g-8grq-fccw

References

Exploit 3

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences