CVE-2019-20049

CVE-2019-20049 is a critical remote code execution vulnerability affecting Alcatel-Lucent OmniVista 4760 devices. It allows an unauthenticated attacker to bypass authentication via a directory traversal vulnerability in the __construct() function, followed by an insecure file upload in SetSkinImages() to execute arbitrary code as SYSTEM. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, its high EPSS and FAUCET Risk Score indicate a substantial potential for exploitation.