Security readout for executives and security teams
Plain-English summary
CVE-2019-25227 is an unauthenticated configuration disclosure issue in Tellion HN-2204AP routers. A remote attacker may be able to retrieve a compressed configuration archive without logging in, potentially exposing administrator credentials, wireless keys, and other sensitive router settings.
Executive priority
High priority for any organization that still operates Tellion HN-2204AP routers, especially if management interfaces are externally reachable. Immediate containment and credential rotation planning are warranted because the issue can expose credentials without authentication and no patch evidence is provided in the bundle.
Technical view
The source bundle describes an unauthenticated access control failure affecting the Tellion HN-2204AP Router, listed with version "0" and CWE-306. The vulnerable management endpoint is /cgi-bin/system_config_file and can expose a compressed configuration archive without authentication or authorization. CVSS v4.0 score is 8.7 High with network attack vector, low complexity, no privileges, and no user interaction required.
Likely exposure
Exposure is most concerning where Tellion HN-2204AP router management interfaces are reachable from the internet or other untrusted networks. The affected product data in the bundle is limited to Tellion HN-2204AP Router version "0" with default status unknown, so asset inventory is required before judging internal exposure.
Exploitation context
The bundle includes a Packet Storm reference tagged as exploit, indicating public exploit-related material exists. The bundle does not mark the CVE as KEV and does not provide evidence of active exploitation, so active exploitation should not be assumed from these sources alone.
Researcher notes
Do not claim active exploitation based on the provided bundle: KEV is false and no source states active exploitation. The source bundle identifies public exploit-related material but does not include a confirmed vendor fix. Affected-version data is sparse, so avoid broadening impact beyond Tellion HN-2204AP Router version "0" without additional evidence.
Mitigation direction
- Identify any Tellion HN-2204AP routers in the environment and determine whether their management interfaces are reachable from untrusted networks.
- Restrict access to router management interfaces using network controls such as firewall rules, VPN-only administration, or management network segmentation.
- Treat exposed router configuration archives as sensitive secrets; rotate administrative credentials, wireless keys, and other credentials if disclosure is suspected.
- Check vendor or trusted advisory guidance for fixed firmware or replacement guidance because the provided source bundle does not include patch evidence.
- Consider retiring or replacing affected devices if no maintained firmware or vendor remediation is available.
Validation and detection
- Confirm whether Tellion HN-2204AP routers are present in asset inventory.
- Verify that router management interfaces are not internet-facing and are limited to authorized administrative networks.
- Review available router, firewall, proxy, or network telemetry for suspicious access to the configuration export endpoint or unexpected configuration archive retrieval.
- Validate that administrative passwords and wireless keys have been rotated where exposure is possible.
- Document the remediation state, including any vendor guidance found outside this bundle before production changes are made.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25227 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://packetstorm.news/files/id/154752/CVE reference · exploit
- https://web.archive.org/web/20190525010559/https://www.tellion.com/CVE reference · product
- https://www.vulncheck.com/advisories/tellion-hn2204ap-unauthenticated-config-disclosureCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.