LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authentication
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.7%
probabilidade de exploração
0.7%top 48% das CVEs
exploração observada
nãonenhuma fonte reporta
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Interface. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
LB-LINK · BL-AC1900LB-LINK · BL-AC2100_AZ3LB-LINK · BL-AC3600LB-LINK · BL-AX1800LB-LINK · BL-AX5400PLB-LINK · BL-WR9000Referências
https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.mdhttps://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md#pochttps://vuldb.com/?ctiid.316272https://vuldb.com/?id.316272https://vuldb.com/?submit.608018