CVE-2019-25249
Authentication Bypass in devolo dLAN 500 AV Enables Root Access
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devolo | dlan_550_duo+ | * |
| devolo | dlan_500_av_wireless+ | 3.1.0-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in devolo dLAN 500 AV Wireless+ 3.1.0-1 allows an attacker with authenticated access to the device's web interface to enable hidden services through the htmlmgr CGI script. By manipulating certain system configuration parameters, the attacker can enable Telnet and a remote shell service, reboot the device remotely, and gain root access without a password. This happens because the firmware fails to properly validate or sanitize these parameters, allowing the attacker to start deprecated services and execute arbitrary code with root privileges. [2, 3]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized root access to the device, allowing an attacker to execute arbitrary code with full privileges. The attacker can enable Telnet and remote shell services without authentication, reboot the device remotely, and potentially take full control over the device. This can lead to system compromise, denial of service, and unauthorized network access through the affected Powerline adapter. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Telnet service is enabled on the affected device, as exploitation results in Telnet being activated on TCP port 23 without authentication. You can scan your network for devices with open Telnet ports using commands like 'nmap -p 23 <device_ip>' or 'telnet <device_ip> 23'. Additionally, monitoring HTTP POST requests to the device's htmlmgr CGI script for parameters such as 'System.Baptization.Telnetd=1' or 'System.Baptization.shell=1' can indicate exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the vulnerable htmlmgr CGI script or restricting access to the device's web administration interface to trusted users only. If possible, disable the Telnet service on the device or block TCP port 23 at the network firewall to prevent unauthorized access. Rebooting the device after configuration changes can help ensure that unauthorized services are not running. Additionally, monitor for any unauthorized configuration changes via the web interface and consider isolating affected devices from critical network segments until a firmware update or patch is available. [3]