Security readout for executives and security teams
Plain-English summary
V-SOL GPON/EPON OLT Platform 2.03 reportedly lets a lower-privileged account become an administrator by changing a role value in a web request. For telecom or ISP environments, compromise of an OLT management interface can affect subscriber service confidentiality, integrity, and availability.
Executive priority
Treat as urgent for exposed or production OLT management systems. Prioritize containment, inventory, and vendor remediation because successful abuse could give administrative control over critical access-network infrastructure.
Technical view
The source bundle describes improper authorization (CWE-863) in V-SOL GPON/EPON OLT Platform v2.03. A user management function trusts a role parameter, allowing privilege escalation to administrative access. CVSS is 9.8. Public exploit material exists, but CISA KEV status is false in the provided data.
Likely exposure
Highest risk is for organizations running V-SOL GPON/EPON OLT Platform 2.03, especially if the web management interface is reachable from untrusted networks or shared operations networks.
Exploitation context
Public exploit reference is listed by Exploit-DB and Zero Science Lab disclosed the issue. The provided sources do not show confirmed active exploitation or KEV listing. Evidence suggests abuse requires access to the management web application context, but the CVSS vector reports PR:N.
Researcher notes
Sources identify CWE-863 and version 2.03, with public exploit material. The bundle has a notable ambiguity: the narrative says normal users escalate privileges, while CVSS lists PR:N. No patch version, vendor advisory details, or active exploitation evidence are provided.
Mitigation direction
- Identify any V-SOL GPON/EPON OLT Platform 2.03 deployments.
- Restrict OLT management interfaces to trusted administration networks only.
- Review vendor guidance or support channels for fixed firmware or configuration mitigations.
- Disable or limit non-admin user accounts until remediation is confirmed.
- Monitor administrative role changes and unexpected account modifications.
Validation and detection
- Inventory OLT firmware and confirm whether version 2.03 is present.
- Verify management interfaces are not internet-exposed.
- Review web administration logs for unexpected privilege or role changes.
- Confirm only authorized users have administrative privileges.
- Track vendor advisories for updates matching this platform and version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25237 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47435CVE reference · exploit
- V-SOL Official Product HomepageCVE reference · product
- Zero Science Lab Disclosure (ZSL-2019-5538)CVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.