Multiple Vendor Router Administration Interface Config insufficiently protected credentials

Summaryinfo

A vulnerability has been found in TOTOLINK/CIK TELECOM/KCTVJEJU/Hi-Wifi/HCN/T-broad Router and classified as problematic. This impacts an unknown function of the component Administration Interface. The manipulation leads to insufficiently protected credentials (Config). This vulnerability is documented as CVE-2019-19822. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in TOTOLINK/CIK TELECOM/KCTVJEJU/Hi-Wifi/HCN/T-broad Router (Router Operating System) (the affected version unknown). This issue affects an unknown part of the component Administration Interface. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability (Config). Using CWE to declare the problem leads to CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Impacted is confidentiality. The summary by CVE is:

A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.

The weakness was released 01/27/2020 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2019-19822 since 12/16/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-149412, VDB-149413 and VDB-149414. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• CIK TELECOM
• HCN
• Hi-Wifi
• KCTVJEJU
• T-broad
• TOTOLINK

Name

• Router

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion