CVE-2019-19356 : Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

Published 2020-02-07 23:15:10

Updated 2022-01-01 19:57:27

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2019-19356

Netis-systems » Wf2419 Firmware » Version: 2.2.36123
cpe:2.3:o:netis-systems:wf2419_firmware:2.2.36123:*:*:*:*:*:*:*
Matching versions
When used together with: Netis-systems » Wf2419 » Version: N/A
Netis-systems » Wf2419 Firmware » Version: 1.2.31805
cpe:2.3:o:netis-systems:wf2419_firmware:1.2.31805:*:*:*:*:*:*:*
Matching versions
When used together with: Netis-systems » Wf2419 » Version: N/A

CVE-2019-19356 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Netis WF2419 Devices Remote Code Execution Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2019-19356

Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2019-19356

EPSS FAQ

95.97%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-19356

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.5	HIGH	AV:N/AC:M/Au:S/C:C/I:C/A:C	6.8	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.6	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-19356

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-19356

https://github.com/shadowgatt/CVE-2019-19356

GitHub - shadowgatt/CVE-2019-19356: Netis router RCE exploit ( CVE-2019-19356)
Exploit;Third Party Advisory
https://www.digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356

Netis Routers - Remote Code Execution (CVE-2019-19356) | Digital Security
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html

Netis WF2419 2.2.36123 Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry