CVE-2019-25706: Across DR-810 Information Disclosure Flaw

CVE-2019-25706 Overview

CVE-2019-25706 is an unauthenticated file disclosure vulnerability affecting the Across DR-810 router. This vulnerability allows remote attackers to download the rom-0 backup file containing sensitive information by sending a simple GET request to the vulnerable endpoint. Attackers can access the rom-0 endpoint without any authentication to retrieve and decompress the backup file, exposing router passwords and other sensitive configuration data.

Critical Impact
Remote unauthenticated attackers can extract sensitive configuration data including router credentials, potentially leading to complete device compromise and network infiltration.

Affected Products

Across DR-810 Router

Discovery Timeline

2026-04-12 - CVE-2019-25706 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2019-25706

Vulnerability Analysis

This vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The Across DR-810 router exposes a backup file endpoint (rom-0) that can be accessed without any authentication mechanism. When this endpoint is requested, the router responds with a compressed backup file containing the complete device configuration, including plaintext or easily recoverable credentials.

The network-accessible nature of this vulnerability means any attacker who can reach the device's web interface can exploit it without requiring any prior authentication or user interaction. This makes it particularly dangerous for internet-facing routers or devices accessible within compromised networks.

Root Cause

The root cause of this vulnerability lies in the improper access control implementation on the Across DR-810 router's web interface. The rom-0 file endpoint lacks authentication checks, allowing any remote user to request and download the router's backup configuration file. This represents a fundamental design flaw where sensitive system files are exposed through the web server without adequate protection mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying an Across DR-810 router accessible over the network
Sending an HTTP GET request to the rom-0 endpoint
Downloading the compressed backup file returned by the router
Decompressing the backup file using readily available tools
Extracting sensitive information including administrator passwords and network configuration

The vulnerability is documented in Exploit-DB #46132, which provides technical details on the exploitation methodology. Additional information is available in the VulnCheck Security Advisory.

Detection Methods for CVE-2019-25706

Indicators of Compromise

HTTP GET requests targeting /rom-0 or similar backup file endpoints on router management interfaces
Unusual outbound data transfers from router management ports
Multiple access attempts to router configuration endpoints from external IP addresses
Presence of decompression tools or backup parsing utilities on network hosts with recent router access

Detection Strategies

Monitor web server logs on network devices for requests to sensitive endpoints like rom-0
Implement network intrusion detection rules to flag unauthenticated access attempts to router backup files
Deploy web application firewalls to block requests to known vulnerable endpoints
Use network traffic analysis to detect large file downloads from router management interfaces

Monitoring Recommendations

Enable comprehensive logging on all network device management interfaces
Configure alerts for access to configuration backup endpoints from unauthorized sources
Regularly audit network device access logs for suspicious patterns
Monitor for reconnaissance activity targeting router management ports (typically 80, 443, 8080)

How to Mitigate CVE-2019-25706

Immediate Actions Required

Restrict access to the router management interface to trusted IP addresses only
Place the router management interface behind a firewall or VPN
Disable remote management access if not required
Monitor for any unauthorized access attempts to the device
Review and change all credentials stored on the device as they may have been compromised

Patch Information

No vendor patch information is currently available for this vulnerability. The Across DR-810 router may be an end-of-life product without active security support. Organizations should consider replacing affected devices with actively supported alternatives that receive regular security updates.

For additional context, refer to the VulnCheck Security Advisory and Exploit-DB #46132.

Workarounds

Implement network-level access controls to restrict management interface access to specific trusted IP addresses or subnets
Deploy the router behind a properly configured firewall that blocks external access to management interfaces
Use a reverse proxy with authentication to protect access to the router's web interface
Consider network segmentation to isolate vulnerable devices from untrusted network segments
Replace the Across DR-810 with a supported router model that receives security updates

bash

# Example firewall rule to restrict router management access (iptables)
# Replace 192.168.1.100 with router IP and 192.168.1.0/24 with trusted subnet
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -j DROP