{"id":"CVE-2019-25239","state":"PUBLISHED","title":"V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download","description":"V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authentication bypass and system access.","publishedAt":"2025-12-24T19:27:57.201Z","updatedAt":"2025-12-24T20:23:32.107Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Guangzhou V-SOLUTION Electronic Technology GPON/EPON OLT Platform"],"affected":[{"vendor":"Guangzhou V-SOLUTION Electronic Technology","product":"GPON/EPON OLT Platform","versions":[{"version":"V2.03.62R_IPv6","status":"affected"},{"version":"V2.03.54R","status":"affected"},{"version":"V2.03.52R","status":"affected"},{"version":"V2.03.49","status":"affected"},{"version":"V2.03.47","status":"affected"},{"version":"V2.03.40","status":"affected"},{"version":"V2.03.26","status":"affected"},{"version":"V2.03.24","status":"affected"},{"version":"V1.8.6","status":"affected"},{"version":"V1.4","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/47433","https://www.vsolcn.com","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5534.php"],"weaknesses":["CWE-552"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25239.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25239","state":"PUBLISHED","datePublished":"2025-12-24T19:27:57.201Z","dateUpdated":"2025-12-24T20:23:32.107Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-24T14:27:12.476Z"},"containers":{"cna":{"title":"V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download","descriptions":[{"lang":"en","value":"V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authentication bypass and system access."}],"affected":[{"vendor":"Guangzhou V-SOLUTION Electronic Technology","product":"GPON/EPON OLT Platform","versions":[{"version":"V2.03.62R_IPv6","status":"affected"},{"version":"V2.03.54R","status":"affected"},{"version":"V2.03.52R","status":"affected"},{"version":"V2.03.49","status":"affected"},{"version":"V2.03.47","status":"affected"},{"version":"V2.03.40","status":"affected"},{"version":"V2.03.26","status":"affected"},{"version":"V2.03.24","status":"affected"},{"version":"V1.8.6","status":"affected"},{"version":"V1.4","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/47433","name":"ExploitDB-47433","tags":["exploit"]},{"url":"https://www.vsolcn.com","name":"V-SOL Official Product Homepage","tags":["product"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5534.php","name":"Zero Science Lab Disclosure (ZSL-2019-5534)","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","lang":"en","description":"Files or Directories Accessible to External Parties","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2025-12-24T19:27:57.201Z"},"datePublic":"2019-09-27T00:00:00.000Z","credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5534.php","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/47433","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-24T20:04:48.457067Z","id":"CVE-2019-25239","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-24T20:23:32.107Z"}}]}}}