CVE

CVE-2019-19824

8.8

CVSS

Description

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.

Attack Vector

Privileges Req.

User Interaction

a3002ru_firmwarea702r_firmwaren301rt_firmwaren302r_firmwaren200re_firmwaren150rt_firmware

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2019-19824 Scanner

CVE-2019-19824 scanner - OS Command Injection vulnerability in various TOTOLINK Realtek SDK based routers

Used 3k times · 4.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: a3002ru_firmware

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →