CVE-2019-25706

CVE-2019-25706 is an unauthenticated file disclosure vulnerability affecting Across DR-810 routers that allows remote attackers to download the rom-0 backup file containing sensitive configuration data and router passwords via a simple GET request to an unprotected endpoint. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, reflecting its network-accessible attack vector, low complexity, and lack of authentication requirements, though impact is limited to confidentiality compromise with no integrity or availability effects. The exploitation status indicates this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows low community attention with an EPSS score of 0.0005, suggesting minimal active exploitation in the wild despite the technical simplicity of the attack.