CVE-2025-7573 is a critical information disclosure vulnerability affecting multiple LB-LINK router models, including BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000. The flaw resides in the bs_GetManPwd function within the libblinkapi.so library of the /cgi-bin/lighttpd.cgi file, allowing remote attackers to extract sensitive information. While rated Medium (CVSS 5.3) due to low impact on confidentiality, its network attack vector and low complexity make it easily exploitable. The exploit has been publicly disclosed, but there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| LB-LINK | BL-AC1900 | 20250702CNA affected | |
| LB-LINK | BL-AC2100 AZ3 | 20250702CNA affected | |
| LB-LINK | BL-AC3600 | 20250702CNA affected | |
| LB-LINK | BL-AX1800 | 20250702CNA affected | |
| LB-LINK | BL-AX5400P | 20250702CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.