High

DATE	CVE	VULNERABILITY TITLE	RISK
2020-01-27	CVE-2019-19824	OS Command Injection vulnerability in Totolink products On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. network low complexity totolink CWE-78	8.8
2020-01-27	CVE-2019-19823	Insufficiently Protected Credentials vulnerability in multiple products A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. network low complexity totolink realtek sapido ciktel kctvjeju fg-products hiwifi tbroad coship iodata hcn-max-c300n-project CWE-522	7.5
2020-01-27	CVE-2019-19822	Missing Authentication for Critical Function vulnerability in multiple products A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). network low complexity totolink realtek sapido ciktel kctvjeju fg-products hiwifi tbroad coship iodata hcn-max-c300n-project CWE-306	7.5