CVE-2019-25235
Published: 24 December 2025
Summary
CVE-2019-25235 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2019-25235 is an authentication bypass vulnerability (CWE-639) in Smartwares HOME easy version 1.0.9. The flaw enables unauthenticated attackers to access administrative web pages by disabling JavaScript, thereby bypassing client-side validation. This critical issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impacts.
Unauthenticated remote attackers can exploit the vulnerability over the network with low complexity and no privileges or user interaction required, per the CVSS vector. By disabling JavaScript, attackers can directly navigate to multiple administrative endpoints and retrieve sensitive system information.
Advisories and further details are available from Zero Science Lab (ZSL-2019-5540 at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php) and the vendor site (https://www.smartwares.eu). A proof-of-concept exploit is published on Exploit-DB (https://www.exploit-db.com/exploits/47595).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205325
Vulnerability details
Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing web application, enabling unauthenticated remote attackers to access administrative endpoints, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces server-side approved authorizations for access to administrative web pages, preventing bypass of client-side JavaScript validation.
Explicitly identifies and restricts actions performable without identification or authentication, prohibiting unauthorized access to sensitive admin endpoints.
Requires identification and authentication for non-organizational users or attackers accessing administrative functions over the network.