CVE-2019-19356
Netis WF2419 Devices Remote Code Execution Vulnerability
Description
CVE-2019-19356 is a high-severity remote code execution vulnerability affecting Netis WF2419 router devices. The vulnerability exists in the tracert diagnostic tool accessible through the router's web management page, which fails to properly sanitize user input, allowing an authenticated attacker to execute arbitrary system commands as root. CISA has added CVE-2019-19356 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 91.1% (99.6th percentile), this Netis WF2419 vulnerability represents an extremely high exploitation risk for organizations using these router devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netis-systems | wf2419 firmware | 1.2.31805; 2.2.36123 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/shadowgatt/CVE-2019-19356(Exploit, Third Party Advisory)
- https://www.digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19356(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')
CWE-78 describes OS command injection vulnerabilities where user-supplied input is passed to operating system commands without proper sanitization. In CVE-2019-19356, the Netis WF2419 router's tracert diagnostic tool on the web management interface incorporates user input directly into system commands executed as root, allowing an authenticated attacker to inject arbitrary OS commands that execute with the highest privileges on the device.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2019-19356 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting a significant security threat to affected network environments. The vulnerability is exploitable over the network, though with high attack complexity, and requires low-level privileges (authenticated access to the router's web management interface), with no user interaction needed. Confidentiality (High): Root-level command execution on the router allows an attacker to intercept and exfiltrate all traffic passing through the device, read stored credentials, and access the complete device configuration. Integrity (High): An attacker with root access can modify router configurations, alter DNS settings to redirect traffic, inject malicious firmware, and manipulate routing tables. Availability (High): Full device control enables the attacker to disrupt network connectivity for all clients depending on the router, effectively causing a network-wide denial of service. The EPSS score of 91.1% places this vulnerability in the 99.6th percentile, indicating near-certain exploitation activity.
Exploit Maturity
CVE-2019-19356 has well-documented exploit maturity with multiple public exploit sources available. Public exploit code is available via Packet Storm Security and a dedicated GitHub exploit repository, along with a detailed technical writeup describing the exploitation methodology. CISA has confirmed active exploitation in the wild through its Known Exploited Vulnerabilities catalog listing. The EPSS score of 91.1% (99.6th percentile) indicates near-certain exploitation, reflecting the combination of publicly available exploit code and the prevalence of vulnerable consumer-grade networking equipment. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Check for and install firmware updates from Netis for the WF2419 model that address the command injection vulnerability in the tracert diagnostic tool.
- Verify the firmware version on all deployed Netis WF2419 devices. Affected firmware versions include V1.2.31805 and V2.2.36123. If no patched firmware is available from the vendor, consider replacing the device with a supported alternative.
- Restrict access to the router's web management interface by disabling remote management access from the WAN side and limiting management access to specific trusted IP addresses on the LAN. Change default administrative credentials to strong, unique passwords.
- Implement network monitoring to detect exploitation attempts against the router, including unusual outbound connections from the router's IP address, DNS configuration changes, and unexpected traffic patterns that may indicate the device has been compromised.
- As a long-term measure, evaluate replacing consumer-grade Netis WF2419 devices with enterprise-grade networking equipment that receives regular security updates and supports centralized management, particularly in business environments where the router handles sensitive traffic.
Technical Details
CVE-2019-19356 is an authenticated remote code execution vulnerability caused by OS command injection (CWE-78) in Netis WF2419 router devices running firmware versions V1.2.31805 and V2.2.36123. The vulnerability resides in the tracert diagnostic tool accessible through the router's web management page. When a user submits a traceroute request, the user-supplied target parameter is incorporated directly into a system command executed with root privileges without any input sanitization or validation. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires authenticated access to the web management interface and the attack complexity is rated high, likely due to the need for valid credentials and specific conditions for reliable command injection. However, once authentication is obtained (which is often trivial on consumer routers with default credentials), an attacker can inject shell metacharacters and arbitrary commands that execute as root on the underlying Linux operating system, granting full control over the device.
Frequently Asked Questions
Is CVE-2019-19356 being actively exploited?
Yes. CVE-2019-19356 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available on Packet Storm Security and GitHub, and the EPSS score of 91.1% (99.6th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2019-19356?
CVE-2019-19356 affects Netis WF2419 router devices running firmware versions V1.2.31805 and V2.2.36123. The vulnerability is in the tracert diagnostic tool on the web management page, which allows authenticated OS command injection as root.
How do I fix CVE-2019-19356?
Check for and apply firmware updates from Netis for the WF2419 model. If no patch is available, restrict access to the web management interface, disable remote management, and consider replacing the device with a supported alternative that receives regular security updates.
How severe is CVE-2019-19356?
CVE-2019-19356 has a CVSS 3.1 score of 7.5 (HIGH). While authentication is required, the ability to execute commands as root on the router combined with an EPSS score in the 99.6th percentile and confirmed active exploitation makes this a critical-priority vulnerability for affected organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.