PT-2026-24768 · Ewon · Ewon

Photubias · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2019-25470

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eWON versions 12.2 through 13.0

Description eWON firmware contains an authentication bypass that allows attackers with minimal privileges to retrieve sensitive user data. Attackers can exploit the wsdReadForm API endpoint by sending POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter. This allows extraction of encrypted passwords for all users, which can be decrypted using a hardcoded XOR key.

Recommendations Versions 12.2 through 13.0 should be updated when a fix becomes available. As a temporary workaround, restrict access to the wsdReadForm endpoint.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-25470

Produtos afetados

Ewon

Referências · 4

• 🔥 https://exploit-db.com/exploits/47380 · Exploit
• https://ewon.biz · Nota
• https://vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25470 · Nota de Segurança