LB-LINK X-PRO shadow hard-coded credentials
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.2epss 1.8%
exploitation probability
1.8%top 23% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
LB-LINK · X-PROpublic PoCs found — 1
cve_referencegithub.com/DavCloudz/cve/blob/main/B-Link/B-Link%20AC1200%20X-PRO(AC6)%20Hardcoded%20Credentials%20Vulnerability.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.