CVE-2019-25284
Reflected XSS in V-SOL GPON/EPON OLT Platform v
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| guangzhou_v-solution_electronic_technology_co_ltd | v-sol_gpon_epon_olt_platform | From 2.03.24 (inc) to 2.03.62R_IPv6 (inc) |
| guangzhou_v-solution_electronic_technology_co_ltd | v-sol_gpon_epon_olt_platform | 1.8.6 |
| guangzhou_v-solution_electronic_technology_co_ltd | v-sol_gpon_epon_olt_platform | 1.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected Cross-Site Scripting (XSS) issue in the V-SOL GPON/EPON OLT Platform version 2.03. It occurs because the platform improperly sanitizes user-supplied input in various script parameters. Attackers can exploit this by injecting malicious HTML or JavaScript code into these parameters, which then executes arbitrary scripts in the victim's browser session when they access the affected web interface. [1, 2]
How can this vulnerability impact me? :
The vulnerability allows remote attackers to execute arbitrary HTML and JavaScript code within a user's browser session. This can lead to unauthorized actions performed on behalf of the user, theft of sensitive information such as cookies or session tokens, and potentially compromise the user's interaction with the affected device's web interface. Since the platform is used in broadband access devices supporting services like VPN, IP Camera, and Enterprise LAN, exploitation could impact network security and user privacy. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing for reflected Cross-Site Scripting (XSS) in the affected platform's web interface, particularly by injecting script payloads into parameters handled by scripts such as those in URLs like /action/bindProfile.html and /action/ntp.html. For example, injecting payloads like "><script>confirm(251)</script>" into parameters such as 'parent' and 'sntp_server' can reveal if the input is improperly sanitized and reflected back. Detection can be performed using web vulnerability scanners or manual testing with curl or browser-based tools to send crafted requests to these endpoints and observe if the script executes in the response. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable web interface to trusted networks only, applying input validation and sanitization on all user-supplied parameters, and updating the V-SOL GPON/EPON OLT Platform to a version where this vulnerability is fixed if available. Additionally, monitoring and filtering HTTP requests to detect and block malicious script injections can help reduce risk until a patch is applied. [1, 2]