← CVE Radar
CVE-2019-19356Netis WF2419 Devices Remote Code Execution Vulnerability
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
7.5 HIGHEPSS 28.07%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 8.5 | HIGH | 2.0NVD | AV:N/AC:M/Au:S/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due May 3, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2019-19356
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Feb 7, 2020
- Last modified
- 2026-06-17 02:26 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
netis-systemswf2419 firmware2 version ranges
- 1.2.31805
- 2.2.36123
References
- packetstormsecurity.com http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html
- github.com https://github.com/shadowgatt/CVE-2019-19356
- digital.security https://www.digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19356