CVE-2019-25351

HighPublic PoC

Published: 18 February 2026

Published

18 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0028 19.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25351 is a high-severity Missing Authorization (CWE-862) vulnerability in Centova Cast (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25351 is a file download vulnerability in Centova Cast version 3.2.11, affecting the server.copyfile API endpoint. This flaw, classified under CWE-862 (Missing Authorization), enables authenticated attackers to retrieve arbitrary system files on the server. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

Authenticated attackers with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By supplying crafted parameters to the server.copyfile endpoint via tools like curl or wget, they can download sensitive files such as /etc/passwd, potentially exposing system credentials, configurations, or other critical data.

Advisories and related resources, including a proof-of-concept exploit, are available from the vendor at https://centova.com, Exploit-DB at https://www.exploit-db.com/exploits/47669, and VulnCheck at https://www.vulncheck.com/advisories/centova-cast-arbitrary-file-download. Security practitioners should consult these for detailed mitigation guidance, such as applying patches if available or restricting API access.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-19639

Vulnerability details

Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using curl and…

wget requests.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Direct file read via unauthenticated API endpoint enables public-facing app exploitation (T1190) and arbitrary local file access (T1005), specifically for credential files (T1552.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0