PT-2025-53335 · Devolo · Devolo Dlan 500 Av Wireless+

Published 2025-12-24 · Updated 2025-12-24 · CVE-2019-25249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions devolo dLAN 500 AV Wireless+ version 3.1.0-1

Description The device contains a flaw that allows attackers to bypass authentication and enable hidden services through the htmlmgr CGI script. Attackers can enable services like telnet and remote shell, reboot the device, and obtain root access without a password by manipulating system configuration parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2019-25249

Affected Products

Devolo Dlan 500 Av Wireless+

References · 5

• 🔥 https://exploit-db.com/exploits/46325 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25249 · Security Note
• https://t.me/CVEtracker/40626 · Telegram Post
• https://devolo.com · Note