CVE-2019-25237
Published: 24 December 2025
Summary
CVE-2019-25237 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2019-25237 is a privilege escalation vulnerability in the V-SOL GPON/EPON OLT Platform version 2.03. It allows normal users to gain administrative access by sending a crafted HTTP POST request to the user management endpoint, specifically by setting the 'user_role_mod' parameter to the integer value '1'. The issue stems from improper handling of the user role parameter, classified under CWE-863 (Incorrect Authorization), with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by normal users over the network without requiring special privileges, user interaction, or authentication beyond basic access, due to the PR:N metric. Successful exploitation grants attackers administrative privileges on the affected OLT platform, enabling full control over confidentiality, integrity, and availability of the system, such as modifying configurations, accessing sensitive data, or disrupting network operations in GPON/EPON environments.
Advisories and references include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/47435), the vendor site (https://www.vsolcn.com), and detailed analysis from Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5538.php), confirming the attack vector but providing no specific patch or mitigation details in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205323
Vulnerability details
V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user_role_mod' set…
more
to integer value '1' to elevate their privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25237 is an unauthenticated privilege escalation in a public-facing web application (user management endpoint on GPON/EPON OLT), directly enabling T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation) via crafted HTTP POST request manipulating user role.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to resources, directly preventing unauthorized privilege escalation through manipulated user role parameters in the user management endpoint.
SI-10 requires validation of information inputs at external interfaces, blocking crafted HTTP POST requests that set the 'user_role_mod' parameter to elevate privileges.
AC-6 mandates least privilege for users and processes, ensuring normal users cannot gain administrative access even if authorization checks fail.