CVE-2019-25237 | THREATINT

Description

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user_role_mod' set to integer value '1' to elevate their privileges.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Incorrect Authorization

Product status

2.03

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5538.php exploit

www.exploit-db.com/exploits/47435 (ExploitDB-47435) exploit

www.vsolcn.com (V-SOL Official Product Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5538.php (Zero Science Lab Disclosure (ZSL-2019-5538)) third-party-advisory

cve.org (CVE-2019-25237)

nvd.nist.gov (CVE-2019-25237)

Download JSON