CVE-2019-25706 HIGH

CVE-2019-25706: Across DR-810 ROM-0 Unauthenticated File Disclosure

Vendor Across
Product DR-810
Weakness CWE-538
Published April 12, 2026
Last update April 13, 2026

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file containing sensitive information by sending a simple GET request. Attackers can access the rom-0 endpoint without authentication to retrieve and decompress the backup file, exposing router passwords and other sensitive configuration data.

Key dates

02Disclosure timeline

April 12, 2026 CVE published
April 13, 2026 Record updated