CVE-2019-25244
CSRF and Stored XSS in Legrand BTicino Driver Manager
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | http_server | 2.2.14 |
| bticino | driver_manager | 1.1.14 |
| openssl | openssl | 1.0.0d |
| php | php | 5.1.6 |
| bticino | driver_manager | 1.0.51 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25244 affects the Legrand BTicino Driver Manager F454 version 1.0.51 and involves multiple web vulnerabilities. Specifically, it includes an authenticated stored Cross-Site Scripting (XSS) flaw where attackers can inject malicious scripts via an unsanitized GET parameter named 'server'. Additionally, it has a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform administrative actions, such as changing passwords, without proper request validation. These flaws enable attackers to execute arbitrary HTML and JavaScript code in the context of the affected site and perform unauthorized administrative actions if a logged-in user visits a malicious website. [1, 2, 4]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute unauthorized administrative actions on the Legrand BTicino Driver Manager F454 system, such as changing passwords via CSRF attacks. The stored XSS vulnerability can lead to execution of malicious scripts in users' browsers, potentially compromising user data, session integrity, and overall system security. This could result in unauthorized access, manipulation of system settings, and exposure of sensitive information. [1, 2, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing for the presence of the authenticated stored Cross-Site Scripting (XSS) flaw via the GET parameter "server" and by checking for Cross-Site Request Forgery (CSRF) vulnerabilities that allow administrative actions without proper request validation. For detection, you can attempt to inject a test script via the "server" parameter in a URL such as /system/time.ntp.php?mode=mine&server=""><marquee>test</marquee> and observe if the script executes in the browser context. Additionally, you can test CSRF by attempting POST requests to endpoints like /system/password.save.php and /system/ownpassword.save.php to see if password changes can be triggered without proper authentication tokens. Using tools like curl or browser developer tools to send these crafted requests can help detect the vulnerability. Example commands include: 1) curl -i -X POST -d "password=newpass" http://target/system/password.save.php 2) Accessing the URL http://target/system/time.ntp.php?mode=mine&server=""><marquee>test</marquee> and checking for script execution. [2, 1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Legrand BTicino Driver Manager F454 web interface to trusted users only, implementing proper authentication and validation mechanisms to prevent unauthorized administrative actions, and disabling or filtering the vulnerable GET parameter "server" to prevent XSS injection. Additionally, avoid visiting untrusted websites while logged into the device's web interface to reduce CSRF risks. Applying any available vendor patches or updates is recommended once released. If patches are not available, consider isolating the device from untrusted networks and monitoring for suspicious activity. [2, 1, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss how the CVE-2019-25244 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA. However, the vulnerability allows attackers to perform unauthorized administrative actions and inject malicious scripts, potentially compromising user data and session integrity. Such security weaknesses could indirectly impact compliance by risking unauthorized access to sensitive information or system controls, which are critical aspects of regulations like GDPR and HIPAA. Still, no direct statements or assessments regarding compliance impact are given in the provided texts. [1, 2, 4]