PT-2025-30436 · Shenzhen Libituo Technology Co. · Lbt-T300-T310

Wuee · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-8019

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shenzhen Libituo Technology LBT-T300-T310 version 2.2.3.6

Description A critical remote buffer overflow vulnerability exists in the sub 40B6F0 function of the /appy.cgi file. The vulnerability is triggered by manipulating the wan proto argument. The exploit for this issue has been publicly disclosed and may be used for remote attacks.

Recommendations For Shenzhen Libituo Technology LBT-T300-T310 version 2.2.3.6, restrict or disable access to the /appy.cgi file. As a temporary workaround, avoid using the wan proto argument in the /appy.cgi endpoint until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2025-8019

Affected Products

Lbt-T300-T310

References · 13

• 🔥 https://github.com/turing-wue/IoT-vul/blob/main/LBT-T300/README.md · Exploit
• 🔥 https://github.com/turing-wue/IoT-vul/blob/main/LBT-T300/README.md#payload · Exploit
• https://osv.dev/vulnerability/CVE-2025-8019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8019 · Security Note
• https://vuldb.com/?submit.619530 · Note
• https://twitter.com/VulmonFeeds/status/1947694190286016857 · Twitter Post
• https://twitter.com/CveFindCom/status/1947683083131466150 · Twitter Post
• https://vuldb.com/?ctiid.317222 · Note
• https://twitter.com/marcin_brz81183/status/1947761247224795220 · Twitter Post
• https://vuldb.com/?id.317222 · Note
• https://twitter.com/CVEnew/status/1947684632926838993 · Twitter Post
• https://t.me/CVEtracker/28396 · Telegram Post
• https://t.me/cvetracker/28396 · Telegram Post