HIGH
eWON Firmware 12.2-13.0 Authentication Bypass via wsdReadForm
Published Mar 11, 2026
8.7
HIGHCVSS 4.0
EPSS 0.39%
Description
eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key.
Affected products
-
Affected
- 12.2 ≤ 13.0
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19744 Advisory
- https://www.ewon.biz product
- https://www.exploit-db.com/exploits/47380 exploit
- https://www.vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19744 | Advisory | |
| https://www.ewon.biz | product | |
| https://www.exploit-db.com/exploits/47380 | exploit | |
| https://www.vulncheck.com/advisories/ewon-firmware-authentication-bypass-via-wsdreadform | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Mar 11, 2026
Updated Jul 15, 2026
Reserved Feb 22, 2026
Link CVE-2019-25470
CISA Vulnrichment
Updated Mar 11, 2026
Red Hat
No data
GitHub
No data