CVE-2019-25235
Published: 24 December 2025
Description
Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.
Mitigating Controls (NIST 800-53 r5)AI
Enforces server-side approved authorizations for access to administrative web pages, preventing bypass of client-side JavaScript validation.
Explicitly identifies and restricts actions performable without identification or authentication, prohibiting unauthorized access to sensitive admin endpoints.
Requires identification and authentication for non-organizational users or attackers accessing administrative functions over the network.
Security SummaryAI
CVE-2019-25235 is an authentication bypass vulnerability (CWE-639) in Smartwares HOME easy version 1.0.9. The flaw enables unauthenticated attackers to access administrative web pages by disabling JavaScript, thereby bypassing client-side validation. This critical issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impacts.
Unauthenticated remote attackers can exploit the vulnerability over the network with low complexity and no privileges or user interaction required, per the CVSS vector. By disabling JavaScript, attackers can directly navigate to multiple administrative endpoints and retrieve sensitive system information.
Advisories and further details are available from Zero Science Lab (ZSL-2019-5540 at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php) and the vendor site (https://www.smartwares.eu). A proof-of-concept exploit is published on Exploit-DB (https://www.exploit-db.com/exploits/47595).
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing web application, enabling unauthenticated remote attackers to access administrative endpoints, directly facilitating T1190: Exploit Public-Facing Application.