Security readout for executives and security teams
Plain-English summary
This flaw lets an unauthenticated remote party download sensitive configuration files from affected V-SOL GPON/EPON OLT platforms. Those files may expose data useful for taking over or bypassing access controls. Treat exposed management interfaces as high business risk, especially for telecom or ISP environments.
Executive priority
Prioritize this for rapid assessment where V-SOL OLTs support customer connectivity or core access networks. The issue can disclose sensitive configuration without login, creating a path to broader operational compromise.
Technical view
CVE-2019-25239 is a CWE-552 information disclosure issue in V-SOL GPON/EPON OLT Platform 2.03-era releases. The CVSS 4.0 score is 8.7. Sources describe unauthenticated direct access to a configuration file endpoint. Public exploit documentation exists, but KEV does not list active exploitation.
Likely exposure
Organizations using listed V-SOL GPON/EPON OLT Platform versions are exposed if the web management interface is reachable by untrusted networks. Internet-facing deployments are the highest concern.
Exploitation context
Attack complexity is low, requires no privileges, and requires no user interaction. ExploitDB and Zero Science Lab references indicate public exploit knowledge. No provided source confirms active exploitation in the wild.
Researcher notes
Affected versions listed include V2.03.62R_IPv6 through older V2.03.x releases, plus V1.8.6 and V1.4. No source in the bundle names a fixed version. Avoid assuming patch availability without vendor confirmation.
Mitigation direction
- Check V-SOL guidance for fixed firmware or official remediation.
- Remove OLT management interfaces from internet exposure.
- Restrict management access to trusted administrative networks or VPNs.
- Review and harden access controls around device configuration files.
- Rotate credentials or secrets if configuration exposure is suspected.
- Monitor management interfaces for suspicious configuration-file access.
Validation and detection
- Inventory V-SOL OLT models and firmware versions.
- Compare firmware against the affected version list.
- Confirm management interfaces are not publicly reachable.
- Review web logs for configuration-file download attempts.
- Verify vendor firmware or mitigation status from official sources.
- Assess whether exposed configuration data contains reusable credentials.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25239 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47433CVE reference · exploit
- V-SOL Official Product HomepageCVE reference · product
- Zero Science Lab Disclosure (ZSL-2019-5534)CVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.