CVE-2025-7572 Overview
CVE-2025-7572 is an information disclosure vulnerability affecting multiple LB-LINK router models, including BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000 running firmware up to version 20250702. The flaw resides in the bs_GetHostInfo function within the libblinkapi.so library, which is invoked through the /cgi-bin/lighttpd.cgi endpoint. Attackers can trigger the vulnerability remotely over the network without authentication. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Unauthenticated remote attackers can retrieve sensitive host information from affected LB-LINK routers via the lighttpd.cgi interface, aiding network reconnaissance and further attacks.
Affected Products
- LB-LINK BL-AC1900, BL-AC2100_AZ3, and BL-AC3600 routers up to firmware 20250702
- LB-LINK BL-AX1800 and BL-AX5400P routers up to firmware 20250702
- LB-LINK BL-WR9000 routers up to firmware 20250702
Discovery Timeline
- 2025-07-14 - CVE-2025-7572 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7572
Vulnerability Analysis
The vulnerability exists in the bs_GetHostInfo function exported by the libblinkapi.so shared library. This function is reached through requests handled by the /cgi-bin/lighttpd.cgi binary on the router's web management interface. When invoked, the function returns host information without enforcing authentication or authorization checks on the requester. As a result, an attacker who can reach the router's HTTP interface can query the endpoint and receive internal device and network data intended for administrative consumption.
Root Cause
The root cause is missing access control on a CGI-accessible API path that exposes host inventory data. The bs_GetHostInfo routine returns information about connected clients and device state without validating session tokens, cookies, or administrative credentials. This design flaw maps to [CWE-200], where sensitive data is transmitted to actors who should not have access.
Attack Vector
Exploitation is network-based and requires no user interaction or credentials. An attacker with reachability to the router's web management interface issues an HTTP request to /cgi-bin/lighttpd.cgi targeting the bs_GetHostInfo handler. The response discloses host information that can be leveraged for reconnaissance, client fingerprinting, and follow-on targeting. Publicly available proof-of-concept material is referenced in the GitHub CVE Analysis and the associated GitHub PoC Repository.
No verified exploit code is reproduced here. Refer to the VulDB entry #316270 for additional technical context.
Detection Methods for CVE-2025-7572
Indicators of Compromise
- Unauthenticated HTTP GET or POST requests to /cgi-bin/lighttpd.cgi invoking the bs_GetHostInfo handler from external or unexpected source IPs.
- Outbound responses from the router management interface containing structured host inventory data returned to non-administrative clients.
- Repeated probing of router web interfaces from a single source IP across multiple LB-LINK devices.
Detection Strategies
- Deploy network intrusion detection signatures that match HTTP requests referencing lighttpd.cgi combined with the bs_GetHostInfo parameter.
- Correlate router web-interface access logs with authenticated session state and flag responses that return host data without a preceding valid login.
- Monitor for anomalous traffic patterns targeting TCP ports 80 and 443 on management interfaces from untrusted network segments.
Monitoring Recommendations
- Forward router syslog and web access logs to a centralized SIEM or data lake for retention and correlation.
- Establish baselines for administrative interface traffic volume and alert on unexpected spikes or off-hours access.
- Track exposure of router management interfaces to the internet using external attack surface monitoring.
How to Mitigate CVE-2025-7572
Immediate Actions Required
- Restrict access to the router web management interface to trusted management VLANs or specific administrative IP addresses.
- Disable remote WAN-side management on affected LB-LINK devices until firmware remediation is available.
- Rotate any credentials or Wi-Fi PSKs that may have been exposed through host information disclosure.
- Inventory all LB-LINK routers listed as affected and identify those reachable from untrusted networks.
Patch Information
No vendor patch is available at the time of publication. The vendor was contacted early in the disclosure process but did not respond. Monitor the VulDB record #316270 and LB-LINK vendor channels for future firmware updates addressing the bs_GetHostInfo handler in libblinkapi.so.
Workarounds
- Place affected routers behind a network firewall that blocks inbound HTTP/HTTPS to the management interface from untrusted sources.
- Use ACLs on upstream network devices to permit management traffic only from administrative subnets.
- Where feasible, replace affected LB-LINK models with devices that receive active security maintenance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
