CVE-2019-25249

8.7 highEPSS 0.4%

devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-266
Published: 2025-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.devolo.com
https://www.exploit-db.com/exploits/46325
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php

Check your stack JSON