CVE-2019-25239

Summary

V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authentication bypass and system access.

Affected Software

VendorProductVersion RangeStatus
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.62R_IPv6affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.54Raffected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.52Raffected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.49affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.47affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.40affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.26affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV2.03.24affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV1.8.6affected
Guangzhou V-SOLUTION Electronic TechnologyGPON/EPON OLT PlatformV1.4affected

Weaknesses

  • CWE-552: Files or Directories Accessible to External Parties

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References