Share
โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”  
MULTIPLE VULNERABILITIES IN SEVERAL SERIES OF  
REALTEK SDK BASED ROUTERS (TOTOLINK AND MANY  
OTHER)  
  
  
Blazej Adamczyk (br0x)  
blazej.adamczyk@gmail.com  
https://sploit.tech/  
โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”  
  
  
11.12.2019  
  
  
  
  
  
1 Sensitive data disclosure and incorrect access control in several series  
of Realtek SDK based routers  
โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•  
  
CVE: CVE-2019-19822  
  
SDK vendor: Realtek  
  
Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,  
MAX-C300N, T-BROAD and possibly others..  
  
Product: Realtek SDK based routers backed by Boa HTTP server (and  
possibly others) and using apmib library for memory management.  
  
Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15  
  
Description: Realtek SDK based routers which use form based instead  
HTTP Basic authentication (that includes Realtek APMIB 0.11f and Boa  
HTTP server 0.94.14rc21) allows remote attackers to retrieve the  
configuration, including sensitive data (usernames and passwords).  
  
This affects:  
โ€ข TOTOLINK A3002RU through 2.0.0,  
โ€ข TOTOLINK 702R through 2.1.3,  
โ€ข TOTOLINK N301RT through 2.1.6,  
โ€ข TOTOLINK N302R through 3.4.0,  
โ€ข TOTOLINK N300RT through 3.4.0,  
โ€ข TOTOLINK N200RE through 4.0.0,  
โ€ข TOTOLINK N150RT through 3.4.0, and  
โ€ข TOTOLINK N100RE through 3.4.0;  
โ€ข Rutek RTK 11N AP through 2019-12-12;  
โ€ข Sapido GR297n through 2019-12-12;  
โ€ข CIK TELECOM MESH ROUTER through 2019-12-12;  
โ€ข KCTVJEJU Wireless AP through 2019-12-12;  
โ€ข Fibergate FGN-R2 through 2019-12-12;  
โ€ข Hi-Wifi MAX-C300N through 2019-12-12;  
โ€ข HCN MAX-C300N through 2019-12-12;  
โ€ข T-broad GN-866ac through 2019-12-12;  
โ€ข Coship EMTA AP through 2019-12-12; and  
โ€ข IO-Data WN-AC1167R through 2019-12-12; and  
โ€ข possibly others.  
  
Technical details: The apmib library at some point of initialization  
dumps the whole memory contents the file /web/config.dat. This folder  
is actually used by the boa http server as index directory.  
Additionally if the router is configured for form-based authentication  
the access control verifies credentials only for some URLs but ".dat"  
files are not restricted. This issue does not affect routers which use  
HTTP Basic authentication to secure all URLs.  
  
PoC:  
โ”Œโ”€โ”€โ”€โ”€  
โ”‚ $ curl http://routerip/config.dat  
โ””โ”€โ”€โ”€โ”€  
  
  
2 Password stored in plaintext in Realtek SDK based routers  
โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•  
  
CVE: CVE-2019-19823  
  
SDK vendor: Realtek  
  
Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,  
MAX-C300N, T-BROAD and possibly others..  
  
Product: Realtek SDK based routers backed by Boa HTTP server (and  
possibly others) and using apmib library for memory management.  
  
Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15  
  
Description: Realtek SDK based routers (that includes Realtek APMIB  
0.11f and Boa HTTP server 0.94.14rc21) store passwords in plaintext.  
  
This affects:  
โ€ข TOTOLINK A3002RU through 2.0.0,  
โ€ข TOTOLINK 702R through 2.1.3,  
โ€ข TOTOLINK N301RT through 2.1.6,  
โ€ข TOTOLINK N302R through 3.4.0,  
โ€ข TOTOLINK N300RT through 3.4.0,  
โ€ข TOTOLINK N200RE through 4.0.0,  
โ€ข TOTOLINK N150RT through 3.4.0, and  
โ€ข TOTOLINK N100RE through 3.4.0;  
โ€ข Rutek RTK 11N AP through 2019-12-12;  
โ€ข Sapido GR297n through 2019-12-12;  
โ€ข CIK TELECOM MESH ROUTER through 2019-12-12;  
โ€ข KCTVJEJU Wireless AP through 2019-12-12;  
โ€ข Fibergate FGN-R2 through 2019-12-12;  
โ€ข Hi-Wifi MAX-C300N through 2019-12-12;  
โ€ข HCN MAX-C300N through 2019-12-12;  
โ€ข T-broad GN-866ac through 2019-12-12;  
โ€ข Coship EMTA AP through 2019-12-12; and  
โ€ข IO-Data WN-AC1167R through 2019-12-12; and  
โ€ข possibly others.  
  
Technical details: Data stored in memory in COMPCS (apmib library)  
format contains device administration and other passwords in  
plaintext. The apmib library additionally at some point of  
initialization dumps the whole memory contents the file  
/web/config.dat which might be used to easily retrieve user passwords.  
  
  
3 Code execution in several TOTOLINK routers  
โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•  
  
CVE: CVE-2019-19824  
  
Vendor: TOTOLINK  
  
Product: TOTOLINK Realtek SDK based routers  
  
Boa Version: <= Boa/0.94.14rc21  
  
Description: On several Realted SDK based TOTOLINK routers, an  
authenticated attacker may execute arbitrary OS commands via the  
sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI  
(syscmd.htm) is not available. This allows for full control over the  
device's internals.  
  
This affects:  
โ€ข A3002RU through 2.0.0,  
โ€ข A702R through 2.1.3,  
โ€ข N301RT through 2.1.6,  
โ€ข N302R through 3.4.0,  
โ€ข N300RT through 3.4.0,  
โ€ข N200RE through 4.0.0,  
โ€ข N150RT through 3.4.0,  
โ€ข N100RE through 3.4.0, and  
โ€ข possibly others.  
  
PoC:  
โ”Œโ”€โ”€โ”€โ”€  
โ”‚ $ curl 'http://routerip/boafrm/formSysCmd' --user "admin:password"   
โ”‚ --data 'submit-url=%2Fsyscmd.htm&sysCmdselect=5&sysCmdselects=0&  
โ”‚ save_apply=Run+Command&sysCmd=cp%20%2Fetc%2Fpasswd%20%2Fweb%2Fxxxx.dat'  
โ””โ”€โ”€โ”€โ”€  
  
  
4 Incorrectly implemented captcha protection in TOTOLINK routers  
โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•  
  
CVE: CVE-2019-19825  
  
Vendor: TOTOLINK  
  
Product: TOTOLINK Realtek SDK based routers  
  
Boa Version: <= Boa/0.94.14rc21  
  
Description: Guessable captcha vulnerability (CWE-804) in several  
series of TOTOLINK routers allows a remote attacker to automatically  
login to the router without reading and providing real captcha.  
  
The following command returns captcha in plain text:  
โ”Œโ”€โ”€โ”€โ”€  
โ”‚ $ curl 'http://routerip/boafrm/formLogin' --data '{"topicurl":"setting/getSanvas"}'  
โ””โ”€โ”€โ”€โ”€  
  
Additionally by using the HTTP Basic in a HEADER the attacker can  
execute router actions without providing captcha at all.  
  
This affects:  
โ€ข A3002RU through 2.0.0,  
โ€ข A702R through 2.1.3,  
โ€ข N301RT through 2.1.6,  
โ€ข N302R through 3.4.0,  
โ€ข N300RT through 3.4.0,  
โ€ข N200RE through 4.0.0,  
โ€ข N150RT through 3.4.0,  
โ€ข N100RE through 3.4.0, and  
โ€ข possibly others.  
  
  
5 Exploiting all together on TOTOLINK routers  
โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•  
  
CVSS v3 socre: 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (assuming  
Administrative Access on WAN is enabled the score is 10.0)  
  
Exploiting all the vulnerabilities together allows a remote  
unauthenticated attacker to execute any code with root permissions and  
reveal administration password.  
  
The only thing that is needed is the access to router administration  
interface (either access to local network or Administrative Access on  
WAN enabled)  
  
Description, video and possibly an exploit:  
https://sploit.tech/2019/12/16/Realtek-TOTOLINK.html  
  
Timeline:  
โ€ข 17.12.2019 - Contacted all identified vendors, i.e. TOTOLINK, CIK  
Telecom, Sapido, Fibergate and Coship.  
โ€ข 18.12.2019 - received TOTOLINK first line support response totally  
not related to my message and showing me how to log into my router.  
I responded right away and asked to forward the message to  
technical/security team.  
โ€ข 19.12.2019 - received response from CIK Telecom stating that the  
routers support encryption (SIC!). I replied asking to forward the  
message to technical/security team.  
โ€ข 19.12.20219 - CIK Telecom responded that for further assistance I  
should contact them over the phone. I replied that I need to explain  
the details as a written message as this is technical.  
โ€ข 27.12.2019, 06.01.2020 - I resent the messages to TOTOLINK and CIK  
Telecom but none have replied till the date of disclosure.  
โ€ข 06.01.2020 - I finally contacted Realtek as the Supplier of the SDK.  
โ€ข 10.01.2020 - I got a response and I replied with encrypted details  
on the bugs.  
โ€ข 14-15.01.2020 - Realtek replied that the issue with dumping  
configuration by apmib exists but it is not directly exploitable in  
the defualt SDK configuration becuase it uses HTTP Basic  
authentication which protects all URLs. They agreed however that  
most of the Vendors modify the software including authentication  
mechanism thus making it vulnerable.  
โ€ข 23.01.2020 - Realtek responded that they are goining to fix the  
issue with dumping configuration to the config.dat file in version  
released on 15.02.2020. They also said that after fixing the issue  
the impact of storing password in plaintext is less significant thus  
they will not fix the CVE-2019-19823 yet but will try to fix it in  
the future.  
  
Temporary workaround: Unfortunately I did not get any good information  
from real vendors like TOTOLINK and for now I would suggest to disable  
administration interface from WAN and restricting LAN router  
administration interface access using some kind of firewall if  
possible.  
  
Credit: Blazej Adamczyk | blazej.adamczyk@gmail.com | http://sploit.tech/