CVE-2019-16313: ifw8 Router ROM credential disclosure in usermanager.htm source

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated credential disclosure with public exploit references and very high EPSS, though not in KEV and requiring network reach to the management page.

What it is

ifw8 Router ROM v4.31 exposes credentials in the HTML source of action/usermanager.htm. Anyone who can reach that page can read the credentials directly from the response, so the flaw undermines the router's authentication model. The record lists firmware products but no specific affected versions beyond v4.31.

Impact

An attacker obtains valid credentials for the router, enabling authenticated access and further configuration or network compromise. The direct impact is credential theft; the CVSS vector rates confidentiality as high with no integrity or availability effect.

Attack surface

Reachable over the network via HTTP to the action/usermanager.htm endpoint. The CVSS vector shows no privileges and no user interaction required, so the page can be fetched directly by an unauthenticated remote client.

Exploitation

Not listed in CISA KEV, but EPSS is 0.46109 (98.75th percentile), indicating high predicted exploitation activity. Both references are tagged Exploit, so public exploit material exists.

What to do

• Apply the vendor firmware update that removes credentials from the usermanager.htm source; if no fix is available, isolate or replace affected devices.
• Restrict management interface access to a trusted management VLAN or VPN and block internet exposure of the router web UI.
• Change default and any exposed credentials on affected devices, and rotate credentials that may have been read from the page.
• Monitor vendor advisories for the listed FR5, FR5-E, FR6, FR6-S and FR8 firmware products for a patched release.

Detection

• Search web/proxy logs for requests to action/usermanager.htm, especially from unexpected or external source addresses.
• Inspect HTTP response bodies for credential-like strings returned from usermanager.htm.
• Alert on management-interface access from outside the trusted management network.
• Review router authentication logs for logins using credentials that appear in exposed page content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.