Actively exploited · Published Feb 7, 2020 · Assigned by mitre

CVE-2019-19356

High 7.5 Exploited

In plain English

A high-severity OS command injection in WF2419 Devices from Netis. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 28.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)28.1%top 1.9% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356 x_refsource_MISC
https://github.com/shadowgatt/CVE-2019-19356 x_refsource_MISC
http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19356 government-resource