CVE-2025-7565

Katalog CVE

CVSS 7.5 · High EPSS 0,71%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada lb-link bl-ac3600 firmware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

14 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Plaintext_Password_Leakage_in_the_Web_Management_Interfa... exploit · advisory pihak ketiga
• https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Plaintext_Password_Leakage_in_the_Web_Management_Interfa... exploit · advisory pihak ketiga
• https://vuldb.com/?id.316263 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.605632 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.316263 permissions required · vdb entry