CVE-2019-25249

HIGH

devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25249 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 24, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

dLAN 550 duo+ Starter Kit

Browse devolo AG / dLAN 550 duo+ Starter Kit
CVE List500 AV Wireless+ 3.1.0-1affected

Proofs of concept

1

Catalogued exploits

ExploitDBdevolo dLAN 550 duo+ Starter Kit - Remote Code ExecutionExploitDB exploitby smNot analyzed1 file
ExploitDB
PoC details

References

4