CVE-2019-25470

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2019-25470", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-22T14:42:43.546Z", "datePublished": "2026-03-11T18:23:13.970Z", "dateUpdated": "2026-07-15T01:23:53.977Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-15T01:23:53.977Z"}, "title": "eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm", "descriptions": [{"lang": "en", "value": "eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use of Hard-coded Credentials", "cweId": "CWE-798", "type": "CWE"}]}], "affected": [{"vendor": "eWON", "product": "eWON", "versions": [{"version": "12.2 <= 13.0", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:ewon:ewon_firmware:12.2_\\<\\=_13.0:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/47380", "name": "ExploitDB-47380", "tags": ["exploit"]}, {"url": "https://www.ewon.biz", "name": "Official Product Homepage", "tags": ["product"]}, {"name": "VulnCheck Advisory: eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform"}], "credits": [{"lang": "en", "value": "Photubias", "type": "finder"}], "x_generator": {"engine": "vulncheck"}, "datePublic": "2019-09-11T00:00:00.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-25470", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T18:46:23.464977Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:31:02.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-25470", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T18:46:23.464977Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:22:57.354Z"}}], "cna": {"title": "eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm", "credits": [{"lang": "en", "type": "finder", "value": "Photubias"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "eWON", "product": "eWON", "versions": [{"status": "affected", "version": "12.2 <= 13.0"}]}], "datePublic": "2019-09-11T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/47380", "name": "ExploitDB-47380", "tags": ["exploit"]}, {"url": "https://www.ewon.biz", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform", "name": "VulnCheck Advisory: eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "Use of Hard-coded Credentials"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ewon:ewon_firmware:12.2_\\<\\=_13.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-15T01:23:53.977Z"}}}, "cveMetadata": {"cveId": "CVE-2019-25470", "state": "PUBLISHED", "dateUpdated": "2026-07-15T01:23:53.977Z", "dateReserved": "2026-02-22T14:42:43.546Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-11T18:23:13.970Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "eWON", "vendor": "eWON", "versions": [{"status": "affected", "version": "12.2 <= 13.0"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key."}, {"lang": "es", "value": "Las versiones de firmware de eWON 12.2 a 13.0 contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n que permite a atacantes con privilegios m\u00ednimos recuperar datos de usuario sensibles explotando el endpoint wsdReadForm. Los atacantes pueden enviar solicitudes POST a /wrcgi.bin/wsdReadForm con credenciales parciales codificadas en base64 y un par\u00e1metro wsdList manipulado para extraer contrase\u00f1as cifradas de todos los usuarios, las cuales pueden ser descifradas utilizando una clave XOR codificada de forma fija."}], "id": "CVE-2019-25470", "lastModified": "2026-06-17T02:32:27.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25470", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T18:46:23.464977Z", "version": "2.0.3"}}]}, "published": "2026-03-11T19:16:00.613", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.ewon.biz"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/47380"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.2,13.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "eWON", "source": "cna", "vendor": "eWON"}, "product": "ewon", "vendor": "ewon"}], "analysis": {"en": {"generated_at": "2026-03-17T15:08:06.858868+00:00", "value": {"mitigation_remediation": ["Check for and apply any available firmware update or patch issued by eWON that addresses the authentication bypass.", "If a patch is not yet available, block or restrict access to the /wrcgi.bin/wsdReadForm endpoint using firewall or web-application-control rules so only authorized management traffic can reach the device.", "Monitor device logs for suspicious POST requests to /wrcgi.bin/wsdReadForm and investigate any anomalies promptly.", "Consider disabling the wsdReadForm feature if the device configuration permits.", "Keep the device firmware updated as soon as an official fix becomes available to eliminate the underlying credential management flaw."], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass with Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "The affected product is eWON firmware from the vendor eWON, specifically versions 12.2 to 13.0.", "description_and_impact": "This vulnerability exists in eWON Firmware versions 12.2 through 13.0 and allows an attacker with minimal privileges to bypass authentication. By sending a POST request to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter, an attacker can retrieve encrypted passwords for all users. The passwords can then be decrypted using a hardcoded XOR key, resulting in credential compromise. The weakness is a credential management flaw identified as CWE-798.", "risk_and_exploitability": "The vulnerability has a CVSS score of 8.7, indicating high severity, but its EPSS score is below 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers need network access to the device and can exploit the vulnerability remotely by crafting requests to the vulnerable endpoint, thereby extracting sensitive credential data."}}}}, "created": "2026-03-12T09:57:14.300728+00:00", "updated": "2026-03-20T15:29:49.003936+00:00", "vendors": ["ewon", "ewon$PRODUCT$ewon"]}