PatchTheCVECVE-2019-6441: An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54
CVE-2019-6441 is a critical-severity flaw (CVSS 9.8) affecting rt3050 firmware, rt3052 firmware, rt7620 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By making a POST request to the apply.cgi file of the router, the attacker can change the admin username and password of the router.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 53.6% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-287 |
| Published | 2019-03-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-6441?
rt3050 firmware: mitigate or apply the listed mitigation; rt3052 firmware: mitigate or apply the listed mitigation; rt7620 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-6441 being exploited?
CVE-2019-6441 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-6441 affect?
CVE-2019-6441 affects rt3050 firmware, rt3052 firmware, rt7620 firmware. Severity is critical (CVSS 9.8). An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current pass
How urgent is CVE-2019-6441?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2019-7564 CRITICAL 9.8 MITIGATE MITIGATE An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices