PT-2025-29424 · Lb Link · Blink Bl-Ac2100 Az3+5

Waiwai24 · Published 2025-07-02 · Updated 2025-07-19 · CVE-2025-7574

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LB-LINK BL-AC1900, BL-AC2100 AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, BL-WR9000 versions up to 20250702

Description A critical vulnerability exists in the Web Interface component of the affected devices. The vulnerability is related to the reboot/restore function within the /cgi-bin/lighttpd.cgi file, leading to improper authentication. This allows for remote attacks. The exploit for this issue has been publicly disclosed. The vendor was informed of the vulnerability but did not respond.

Recommendations LB-LINK BL-AC1900 versions prior to 20250702 LB-LINK BL-AC2100 AZ3 versions prior to 20250702 LB-LINK BL-AC3600 versions prior to 20250702 LB-LINK BL-AX1800 versions prior to 20250702 LB-LINK BL-AX5400P versions prior to 20250702 LB-LINK BL-WR9000 versions prior to 20250702 As a temporary workaround, consider disabling access to the /cgi-bin/lighttpd.cgi file until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-09119

CVE-2025-7574

Affected Products

Lb-Link Bl-Ac1900

Blink Bl-Ac2100 Az3

Lb-Link Bl-Ac3600

Lb-Link Bl-Ax1800

Lb-Link Bl-Ax5400P

Lb-Link Bl-Wr9000

References · 14

• 🔥 https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md#poc · Exploit
• 🔥 https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md · Exploit
• https://bdu.fstec.ru/vul/2025-09119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7574 · Security Note
• https://twitter.com/cracbot/status/1946525477126201720 · Twitter Post
• https://vuldb.com/?submit.608018 · Note
• https://t.me/cvenotify/128861 · Telegram Post
• https://t.me/cvenotify/128799 · Telegram Post
• https://twitter.com/CveFindCom/status/1944625489768853723 · Twitter Post
• https://twitter.com/CVEnew/status/1944628631030161590 · Twitter Post
• https://vuldb.com/?ctiid.316272 · Note
• https://t.me/cvetracker/27737 · Telegram Post
• https://vuldb.com/?id.316272 · Note
• https://twitter.com/VulmonFeeds/status/1944644586179022891 · Twitter Post