CVE-2019-25249
Critical
Description
devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.
SeverityCritical
CVSS9.8
Exploit probability—
ProductdLAN 550 duo+ Starter Kit
PublishedDec 24, 2025
First seenDec 24, 2025
Weakness typeCWE-266CWE-266
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| devolo AG dLAN 550 duo+ Starter Kit | 500 AV Wireless+ 3.1.0-1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.