How severe is CVE-2019-19356?

CVE-2019-19356 has a CVSS 3.1 base score of 7.5 (HIGH). EPSS estimates a 28.2% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2019-19356: Netis WF2419 Devices Remote Code Execution

CISA Known Exploited Vulnerabilities

Netis WF2419 Devices Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-11-03

Remediation due

2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2019-19356

Description

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

Severity

CVSS 3.1 · CISA7.5 HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Exploitation Context

as of October 13, 2026

All KEV statistics→

CISA added CVE-2019-19356 to the KEV catalog 635 days after its CVE record was published.
Its current EPSS score (28.2%) is higher than that of 40% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

3 Links

Other references

Record Details

Published

2020-02-07

Last updated

2025-10-21

Assigner (CNA)

mitre

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.