CVE-2019-25706
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Apr 12, 2026
CISA due date
—
The record
Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file containing sensitive information by sending a simple GET request. Attackers can access the rom-0 endpoint without authentication to retrieve and decompress the backup file, exposing router passwords and other sensitive configuration data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory… CWE-538
- GHSA-9c83-rr99-vfwj MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at… CWE-538
- CVE-2026-50099 During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and… CWE-538
- CVE-2026-50565 Fission is an open-source, Kubernetes-native serverless framework that simplifies the… CWE-538
- CVE-2026-46617 Fission is an open-source, Kubernetes-native serverless framework that simplifies the… CWE-538
- CVE-2026-29114 A vulnerability has been found in some Dahua products. CWE-538
- CVE-2019-25717 Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information… CWE-538
- CVE-2026-10254 A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. CWE-538