CVE-2019-25470
eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key.
| CWE | CWE-798 |
| Vendor | ewon |
| Product | ewon |
| Published | Mar 11, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for ewon ewon
Be the first to know when new high vulnerabilities affecting ewon ewon are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
eWON / eWON
12.2 <= 13.0
References
Credits
Photubias