Is CVE-2019-25351 actively exploited?

A weaponized exploit exists for CVE-2019-25351, making exploitation likely. It is not yet confirmed in the CISA KEV catalog.

Can CVE-2019-25351 be exploited remotely?

Yes. CVE-2019-25351 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-25351?

CVE-2019-25351 has a CVSS score of 8.8 (HIGH) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2019-25351

HIGHWEAPONIZED

CVE-2019-25351

CWE-862Published: February 18, 2026· Updated: Feb 19, 2026

8.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.0th

Official Description

Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using curl and wget requests.

NVD Source

Technical Analysis

CVE-2019-25351 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

A weaponized exploit for CVE-2019-25351 is publicly known. This significantly lowers the barrier for threat actors and increases the urgency for remediation.