HOMEVULNERABILITIESCVE-2019-18990
MEDIUM

CVE-2019-18990

CWE-290Published: September 30, 2020· Updated: Jun 17, 2026

5.4
CVSS v3.1

Official Description

A partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0, RTL8192ER 2.10, and RTL8881AN 1.09 devices. The vulnerability allows sending an unencrypted data frame to a WPA2-protected WLAN router where the packet is routed through the network. If successful, a response is sent back as an encrypted frame, which would allow an attacker to discern information or potentially modify data.

NVD Source

Technical Analysis

CVE-2019-18990 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorAdjacent
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Vendors & Products

realtek8 product(s)
rtl8812ar firmwarertl8812arrtl8196d firmwarertl8196drtl8192er firmwarertl8192errtl8881an firmwarertl8881an
Source: NVD CPE · 8 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://www.synopsys.com/blogs/software-security/cyrc-advisory-sept2020/
ADVISORYhttps://www.synopsys.com/blogs/software-security/cyrc-advisory-sept2020/

All References (2)

→
https://www.synopsys.com/blogs/software-security/cyrc-advisory-sept2020/Third Party Advisory
→
https://www.synopsys.com/blogs/software-security/cyrc-advisory-sept2020/Third Party Advisory

Quick Facts

CVE IDCVE-2019-18990
CVSS Score5.4 / 10
SeverityMEDIUM
WeaknessCWE-290
CISA KEVNo
Affected1 vendor(s)
PublishedSep 30, 2020

Related CVEs (CWE-290)

CVE-2026-39858
10.0
CVE-2026-6213
10.0
CVE-2025-34063
10.0
CVE-2020-5415
10.0
CVE-2026-54782
10.0
CVE-2025-49002
9.8

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2019-18990 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2019-18990·NVD