CVE-2019-25249

The record

devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.

Affected packages

Related vulnerabilities

• CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
• CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
• CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
• CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266
• CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. CWE-266
• CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution… CWE-266
• CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. CWE-266
• CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. CWE-266