CVE-2019-25470 eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm
Attackers can bypass authentication to extract encrypted user passwords from eWON devices using a hardcoded key, leading to potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25470?
CVE-2019-25470 is a high-severity authentication bypass vulnerability in eWON, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key.
Weakness: CWE-798
Which versions are affected by CVE-2019-25470?
How do I fix CVE-2019-25470?
No fix has been published for CVE-2019-25470 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-25470 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25470 exists.
Sources
Also known as GHSA-jcxq-mj3r-cxrh.