CVE-2019-25249 | THREATINT

Description

devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Incorrect Privilege Assignment

Product status

500 AV Wireless+ 3.1.0-1

affected

Credits

Stefan Petrushevski aka sm @zeroscience finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php exploit

www.exploit-db.com/exploits/46325 (ExploitDB-46325) exploit

www.devolo.com (Official Vendor Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php (Zero Science Lab Disclosure (ZSL-2019-5508)) third-party-advisory

cve.org (CVE-2019-25249)

nvd.nist.gov (CVE-2019-25249)

Download JSON