CVE-2019-6441

CVE-2019-6441 describes a critical unauthenticated password reset vulnerability affecting several Shenzhen Coship RT3050, RT3052, RT7620, and WM3300 router models. This flaw allows an unauthenticated attacker to change the administrative username and password by sending a POST request to the apply.cgi file, bypassing any authentication or current password validation. With a CVSS score of 9.8 (CRITICAL), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an ExploitDB proof-of-concept exists, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.