PT-2025-29422 · Lb Link+1 · Lb-Link Bl-Ax5400P+6

Waiwai24

·

Published

2025-07-02

·

Updated

2025-07-14

·

CVE-2025-7572

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions: LB-LINK BL-AC1900 LB-LINK BL-AC2100 AZ3 LB-LINK BL-AC3600 LB-LINK BL-AX1800 LB-LINK BL-AX5400P LB-LINK BL-WR9000 versions up to 20250702
Description: A critical vulnerability exists that leads to information disclosure. The vulnerability affects the bs GetHostInfo function within the libblinkapi.so library, located in the /cgi-bin/lighttpd.cgi file. The attack can be initiated remotely. The exploit has been publicly disclosed.
Recommendations: For LB-LINK BL-AC1900, BL-AC2100 AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000 versions up to 20250702, update to a newer version that addresses this issue. As a temporary workaround, consider restricting access to the /cgi-bin/lighttpd.cgi file to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200CWE-284

Related Identifiers

BDU:2025-09782
CVE-2025-7572

Affected Products

Lb-Link Bl-Ac1900
Blink Bl-Ac2100 Az3
Lb-Link Bl-Ac3600
Lb-Link Bl-Ax1800
Lb-Link Bl-Ax5400P
Lb-Link Bl-Wr9000
Libblinkapi.So