CVE-2019-25239 V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download
Attackers can download sensitive configuration files from V-SOL OLT devices without authentication, potentially leading to system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25239?
CVE-2019-25239 is a high-severity vulnerability in Guangzhou V-SOLUTION Electronic Technology GPON/EPON OLT Platform, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authentication bypass and system access.
Weakness: CWE-552
Which versions are affected by CVE-2019-25239?
How do I fix CVE-2019-25239?
No fix has been published for CVE-2019-25239 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-25239 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25239 exists.
Sources
Also known as GHSA-43qf-qj5j-5r47.