High severity · published Feb 7, 2020
CVE-2019-19356
Netis WF2419 Devices Remote Code Execution Vulnerability
In wildKEV
7.5
CVSS
28.1%
EPSS
Yes
On KEV
Description
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)28.1% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
WF
Wf2419 Firmware · Netis-systems
1.2.31805; 2.2.36123 · source: NVD
WD
WF2419 Devices · Netis
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19356
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356
x_refsource_MISC
https://github.com/shadowgatt/CVE-2019-19356
x_refsource_MISC
http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html
More from Wf2419 Firmware
8.8
CVE-2018-6391
A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices
5.4
CVE-2018-5967
Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page
5.4
CVE-2018-6190
Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page