PT-2025-48191 · Tellion · Tellion Hn-2204Ap

Todor Donev · Published 2025-11-26 · Updated 2025-11-27 · CVE-2019-25227

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tellion HN-2204AP routers (affected versions not specified)

Description Tellion HN-2204AP routers have an issue where the /cgi-bin/system config file management endpoint allows remote retrieval of a compressed configuration archive without authentication or authorization. The exposed configuration may contain administrative credentials, wireless keys, and other sensitive settings. This could allow an unauthenticated attacker to obtain information that could facilitate further compromise of the device or network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-25227

Affected Products

Tellion Hn-2204Ap

References · 6

• 🔥 https://packetstorm.news/files/id/154752 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25227 · Security Note
• https://t.me/cveNotify/144145 · Telegram Post
• https://web.archive.org/web/20190525010559/https://tellion.com · Note
• https://vulncheck.com/advisories/tellion-hn2204ap-unauthenticated-config-disclosure · Note
• https://t.me/CVEtracker/38328 · Telegram Post