CVE-2025-7572: LB-LINK BL-WR9000 lighttpd.cgi bs_GetHostInfo information disclosure
A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bsGetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7572?
CVE-2025-7572 is classified as a critical vulnerability.
Which products are affected by CVE-2025-7572?
CVE-2025-7572 affects LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P, and BL-WR9000 devices up to version 20250702.
How does CVE-2025-7572 affect the system?
CVE-2025-7572 affects the function bs_GetHostInfo in the library libblinkapi.so within the /cgi-bin/lighttpd.cgi file.
How do I fix CVE-2025-7572?
To mitigate CVE-2025-7572, upgrade your device firmware to a version released after 20250702.
What are the potential risks of exploiting CVE-2025-7572?
Exploitation of CVE-2025-7572 could lead to unauthorized access or manipulation of sensitive host information.