CVE-2019-25706: Across DR-810 Information Disclosure Flaw

CVE-2019-25706 Overview

CVE-2019-25706 is an unauthenticated file disclosure vulnerability affecting the Across DR-810 router. This vulnerability allows remote attackers to download the rom-0 backup file containing sensitive information by sending a simple GET request to the vulnerable endpoint. Attackers can access the rom-0 endpoint without any authentication to retrieve and decompress the backup file, exposing router passwords and other sensitive configuration data.

Critical Impact

Remote unauthenticated attackers can extract sensitive configuration data including router credentials, potentially leading to complete device compromise and network infiltration.

Affected Products

• Across DR-810 Router

Discovery Timeline

• 2026-04-12 - CVE-2019-25706 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2019-25706

Vulnerability Analysis

This vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The Across DR-810 router exposes a backup file endpoint (rom-0) that can be accessed without any authentication mechanism. When this endpoint is requested, the router responds with a compressed backup file containing the complete device configuration, including plaintext or easily recoverable credentials.

The network-accessible nature of this vulnerability means any attacker who can reach the device's web interface can exploit it without requiring any prior authentication or user interaction. This makes it particularly dangerous for internet-facing routers or devices accessible within compromised networks.

Root Cause

The root cause of this vulnerability lies in the improper access control implementation on the Across DR-810 router's web interface. The rom-0 file endpoint lacks authentication checks, allowing any remote user to request and download the router's backup configuration file. This represents a fundamental design flaw where sensitive system files are exposed through the web server without adequate protection mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an Across DR-810 router accessible over the network
2. Sending an HTTP GET request to the rom-0 endpoint
3. Downloading the compressed backup file returned by the router
4. Decompressing the backup file using readily available tools
5. Extracting sensitive information including administrator passwords and network configuration

The vulnerability is documented in Exploit-DB #46132, which provides technical details on the exploitation methodology. Additional information is available in the VulnCheck Security Advisory.

Detection Methods for CVE-2019-25706

Indicators of Compromise

• HTTP GET requests targeting /rom-0 or similar backup file endpoints on router management interfaces
• Unusual outbound data transfers from router management ports
• Multiple access attempts to router configuration endpoints from external IP addresses
• Presence of decompression tools or backup parsing utilities on network hosts with recent router access

Detection Strategies

• Monitor web server logs on network devices for requests to sensitive endpoints like rom-0
• Implement network intrusion detection rules to flag unauthenticated access attempts to router backup files
• Deploy web application firewalls to block requests to known vulnerable endpoints
• Use network traffic analysis to detect large file downloads from router management interfaces

Monitoring Recommendations

• Enable comprehensive logging on all network device management interfaces
• Configure alerts for access to configuration backup endpoints from unauthorized sources
• Regularly audit network device access logs for suspicious patterns
• Monitor for reconnaissance activity targeting router management ports (typically 80, 443, 8080)

How to Mitigate CVE-2019-25706

Immediate Actions Required

• Restrict access to the router management interface to trusted IP addresses only
• Place the router management interface behind a firewall or VPN
• Disable remote management access if not required
• Monitor for any unauthorized access attempts to the device
• Review and change all credentials stored on the device as they may have been compromised

Patch Information

No vendor patch information is currently available for this vulnerability. The Across DR-810 router may be an end-of-life product without active security support. Organizations should consider replacing affected devices with actively supported alternatives that receive regular security updates.

For additional context, refer to the VulnCheck Security Advisory and Exploit-DB #46132.

Workarounds

• Implement network-level access controls to restrict management interface access to specific trusted IP addresses or subnets
• Deploy the router behind a properly configured firewall that blocks external access to management interfaces
• Use a reverse proxy with authentication to protect access to the router's web interface
• Consider network segmentation to isolate vulnerable devices from untrusted network segments
• Replace the Across DR-810 with a supported router model that receives security updates

# Example firewall rule to restrict router management access (iptables)
# Replace 192.168.1.100 with router IP and 192.168.1.0/24 with trusted subnet
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -j DROP