CVE-2019-25239
Unauthenticated Information Disclosure in V-SOL GPON/EPON OLT Platform
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| v-sol | gpon_epon_olt_platform | 2.03 |
| v-sol | gpon_epon_olt_platform | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-552 | The product makes files or directories accessible to unauthorized actors, even though they should not be. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in V-SOL GPON/EPON OLT Platform version 2.03 allows unauthenticated attackers to download the device's configuration file (usrcfg.conf) by sending a direct HTTP GET request exploiting an insecure direct object reference (IDOR). This leads to exposure of sensitive system information and enables attackers to bypass authentication, escalate privileges, and potentially fully compromise the system. [1, 2]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to disclosure of sensitive configuration data, which may allow attackers to bypass authentication mechanisms, escalate privileges, and potentially take full control of the affected device. This can compromise the security and operation of broadband access networks relying on these devices. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending unauthenticated HTTP GET requests to the vulnerable device targeting the configuration file endpoints. Example commands to test for the vulnerability include: curl http://[device_ip]/device/usrcfg.conf curl http://[device_ip]/action/usrcfg.conf If the configuration file is returned without authentication, the device is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include restricting access to the device's web management interface to trusted networks only, implementing network-level access controls such as firewalls or VPNs to limit exposure, and monitoring for unauthorized access attempts. Additionally, applying any available vendor patches or updates that address this vulnerability is critical. If patches are not available, consider disabling or restricting access to the vulnerable endpoint (usrcfg.conf) if possible. Regularly audit device configurations and logs for suspicious activity related to configuration file downloads. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.