I have found multiple vulnerabilities in several series of Realtek SDK based routers (among them many TOTOLINK models but there are also multiple other vendors affected). Considering TOTOLINK all four vulnerabilities taken together allow to take a full control over te router including code execution.

Exploiting all the vulnerabilities together allows a remote unauthenticated attacker to execute any code with root permissions and reveal administration password.

CVSS v3 socre: 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
(assuming Administrative Access on WAN is enabled the score is 10.0)

Video:

Impact: Quick statistical analysis (using indexing engines) showed that there are 700 000 devices which are using Boa in the mentioned version. A test on a large sample (70 000+) revealed that in the sample 10% are vulnerable devices. This means that statistically there are around 70 000 vulnerable devices accessible from the Internet.

Exploit: As there are so many vulnerable devices I’m publishing the exploit code in order to draw more attention to the potential impact here.
I kindly ask to spread information about the threat to make the users aware of the problem.

Temporary workaround: Unfortunately I did not get any good information from real vendors like TOTOLINK and for now I would suggest to disable administration interface from WAN and restricting LAN router administration interface access using some kind of firewall if possible.

Limitations: The only thing that is needed is the access to router administration interface (either access to local network or Administrative Access on WAN enabled).

1. Sensitive data disclosure and incorrect access control in several series of Realtek SDK based routers

CVE: CVE-2019-19822

SDK vendor: Realtek

Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc., MAX-C300N, T-BROAD and possibly others..

Product: Realtek SDK based routers backed by Boa HTTP server (and possibly others) and using apmib library for memory management.

Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15

Description: Realtek SDK based routers which use form based instead HTTP Basic authentication (that includes Realtek APMIB 0.11f and Boa HTTP server 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords).

This affects:

• TOTOLINK A3002RU through 2.0.0,
• TOTOLINK 702R through 2.1.3,
• TOTOLINK N301RT through 2.1.6,
• TOTOLINK N302R through 3.4.0,
• TOTOLINK N300RT through 3.4.0,
• TOTOLINK N200RE through 4.0.0,
• TOTOLINK N150RT through 3.4.0, and
• TOTOLINK N100RE through 3.4.0;
• Rutek RTK 11N AP through 2019-12-12;
• Sapido GR297n through 2019-12-12;
• CIK TELECOM MESH ROUTER through 2019-12-12;
• KCTVJEJU Wireless AP through 2019-12-12;
• Fibergate FGN-R2 through 2019-12-12;
• Hi-Wifi MAX-C300N through 2019-12-12;
• HCN MAX-C300N through 2019-12-12;
• T-broad GN-866ac through 2019-12-12;
• Coship EMTA AP through 2019-12-12; and
• IO-Data WN-AC1167R through 2019-12-12; and
• possibly others.

Technical details: The apmib library at some point of initialization dumps the whole memory contents the file /web/config.dat. This folder is actually used by the boa http server as index directory. Additionally if the router is configured for form-based authentication the access control verifies credentials only for some URLs but “.dat” files are not restricted. This issue does not affect routers which use HTTP Basic authentication to secure all URLs.

PoC:

$ curl http://routerip/config.dat

2. Passwords stored in plaintext

CVE: CVE-2019-19823

SDK vendor: Realtek

Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc., MAX-C300N, T-BROAD and possibly others..

Product: Realtek SDK based routers backed by Boa HTTP server (and possibly others) and using apmib library for memory management.

Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15

Description: Realtek SDK based routers (that includes Realtek APMIB 0.11f and Boa HTTP server 0.94.14rc21) store passwords in plaintext.

This affects:

• TOTOLINK A3002RU through 2.0.0,
• TOTOLINK 702R through 2.1.3,
• TOTOLINK N301RT through 2.1.6,
• TOTOLINK N302R through 3.4.0,
• TOTOLINK N300RT through 3.4.0,
• TOTOLINK N200RE through 4.0.0,
• TOTOLINK N150RT through 3.4.0, and
• TOTOLINK N100RE through 3.4.0;
• Rutek RTK 11N AP through 2019-12-12;
• Sapido GR297n through 2019-12-12;
• CIK TELECOM MESH ROUTER through 2019-12-12;
• KCTVJEJU Wireless AP through 2019-12-12;
• Fibergate FGN-R2 through 2019-12-12;
• Hi-Wifi MAX-C300N through 2019-12-12;
• HCN MAX-C300N through 2019-12-12;
• T-broad GN-866ac through 2019-12-12;
• Coship EMTA AP through 2019-12-12; and
• IO-Data WN-AC1167R through 2019-12-12; and
• possibly others.

Technical details: Data stored in memory in COMPCS (apmib library) format contains device administration and other passwords in plaintext. The apmib library additionally at some point of initialization dumps the whole memory contents the file /web/config.dat which might be used to easily retrieve user passwords.

3. Code execution in several (TOTOLINK routers)

CVE: CVE-2019-19824

Vendor: TOTOLINK

Product: TOTOLINK Realtek SDK based routers

Boa Version: <= Boa/0.94.14rc21

Description: On several Realted SDK based TOTOLINK routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device’s internals.

This affects:

• A3002RU through 2.0.0,
• A702R through 2.1.3,
• N301RT through 2.1.6,
• N302R through 3.4.0,
• N300RT through 3.4.0,
• N200RE through 4.0.0,
• N150RT through 3.4.0,
• N100RE through 3.4.0, and
• possibly others.

PoC:

$ curl 'http://target/boafrm/formSysCmd' --user "admin:password" 
  --data 'submit-url=%2Fsyscmd.htm&sysCmdselect=5&sysCmdselects=0&
  save_apply=Run+Command&sysCmd=cp%20%2Fetc%2Fpasswd%20%2Fweb%2Fxxxx.dat'

4. Incorrectly implemented captcha protection (TOTOLINK routers)

CVE: CVE-2019-19825

Vendor: TOTOLINK

Product: TOTOLINK Realtek SDK based routers

Boa Version: <= Boa/0.94.14rc21

Description: Guessable captcha vulnerability (CWE-804) in several series of TOTOLINK routers allows a remote attacker to automatically login to the router without reading and providing real captcha.

The following command returns captcha in plain text:

$ curl 'http://target/boafrm/formLogin' --data '{"topicurl":"setting/getSanvas"}'

Additionally by using the HTTP Basic in a HEADER the attacker can execute router actions without providing captcha at all.

This affects:

• A3002RU through 2.0.0,
• A702R through 2.1.3,
• N301RT through 2.1.6,
• N302R through 3.4.0,
• N300RT through 3.4.0,
• N200RE through 4.0.0,
• N150RT through 3.4.0,
• N100RE through 3.4.0, and
• possibly others.

Timeline

• 17.12.2019 - Contacted all identified vendors, i.e. TOTOLINK, CIK Telecom, Sapido, Fibergate and Coship.
• 18.12.2019 - received TOTOLINK first line support response totally not related to my message and showing me how to log into my router. I responded right away and asked to forward the message to technical/security team.
• 19.12.2019 - received response from CIK Telecom stating that the routers support encryption (SIC!). I replied asking to forward the message to technical/security team.
• 19.12.20219 - CIK Telecom responded that for further assistance I should contact them over the phone. I replied that I need to explain the details as a written message as this is technical.
• 27.12.2019, 06.01.2020 - I resent the messages to TOTOLINK and CIK Telecom but none have replied till the date of disclosure.
• 06.01.2020 - I finally contacted Realtek as the Supplier of the SDK.
• 10.01.2020 - I got a response and I replied with encrypted details on the bugs.
• 14-15.01.2020 - Realtek replied that the issue with dumping configuration by apmib exists but it is not directly exploitable in the defualt SDK configuration becuase it uses HTTP Basic authentication which protects all URLs. They agreed however that most of the Vendors modify the software including authentication mechanism thus making it vulnerable.
• 23.01.2020 - Realtek responded that they are goining to fix the issue with dumping configuration to the config.dat file in version released on 15.02.2020. They also said that after fixing the issue the impact of storing password in plaintext is less significant thus they will not fix the CVE-2019-19823 yet but will try to fix it in the future.

Credit: Blazej Adamczyk (br0x)