CVE-2019-19356
KEVNetis WF2419 Devices Remote Code Execution Vulnerability
Description
Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedFeb 7, 2020
Last modifiedJun 17, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- packetstormsecurity.com/files/156588/Netis-WF2419-2.2.36123-Remote-Code-Execution.htmlExploitThird Party Advisory
- github.com/shadowgatt/CVE-2019-19356ExploitThird Party Advisory
- digital.security/en/blog/netis-routers-remote-code-execution-cve-2019-19356ExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19356US Government Resource
0 recent articles mention this CVE
70
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1637 days
- CVSS
- 7.5 HIGH
- EPSS (30-day exploit probability)
- 28.1% · top 2% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.