CVE-2019-25238
CSRF in V-SOL GPON/EPON OLT Allows Unauthorized Admin Actions
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| guangzhou_v-solution_electronic_technology_co_ltd | v-sol_gpon/ep_on_olt_platform | * |
| guangzhou_v-solution_electronic_technology_co_ltd | v-sol_gpon/ep_on_olt_platform | 2.03 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the V-SOL GPON/EPON OLT Platform version 2.03. It allows attackers to perform administrative actions without the user's consent by tricking authenticated administrators into loading malicious web pages. Because the platform's web interface does not validate the authenticity of HTTP requests, an attacker can craft malicious requests that create admin users, enable SSH, or modify system settings remotely when an authenticated user visits a specially crafted page. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to gain unauthorized administrative control over the affected device. They can create new administrative users, enable SSH access, or change system configurations without your knowledge or consent. This can lead to unauthorized access, potential device compromise, and disruption of services provided by the device. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized administrative HTTP POST requests to the device's web management interface endpoints such as /action/user.html and /action/sshglobal.html. Specifically, look for POST requests that create new admin users or enable SSH without proper authentication tokens or origin validation. Network traffic inspection tools or web server logs can be used to identify such suspicious requests. Example commands include using curl to simulate or detect these requests, e.g., curl commands that POST to /action/user.html with parameters to add users or to /action/sshglobal.html to enable SSH. Additionally, inspecting web server logs for unexpected POST requests to these endpoints can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the web management interface to trusted networks or IP addresses, disabling web-based administrative access if possible, and educating administrators to avoid visiting untrusted websites while logged into the device. Applying any available firmware updates or patches from the vendor that address CSRF protections is recommended. If patches are not available, consider implementing network-level protections such as web application firewalls to block unauthorized POST requests to sensitive endpoints. Additionally, changing default credentials and monitoring for unauthorized administrative changes can help reduce risk. [1, 2]