CVE-2025-7572

LB-LINK BL-WR9000 lighttpd.cgi bs_GetHostInfo information disclosure

CVSS 6.9 MEDIUMEPSS 0.3%CWE-200 CWE-284

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.9EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 jul 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Produtos afetados

LB-LINK · BL-AC1900 LB-LINK · BL-AC2100_AZ3 LB-LINK · BL-AC3600 LB-LINK · BL-AX1800 LB-LINK · BL-AX5400P LB-LINK · BL-WR9000

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Information_Exposure_Vulnerabilities_in_Various_Blink_Router_Models.md https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Information_Exposure_Vulnerabilities_in_Various_Blink_Router_Models.md#poc https://vuldb.com/?ctiid.316270 https://vuldb.com/?id.316270 https://vuldb.com/?submit.608009