CVE-2025-4076

Summary

A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cgi-bin/lighttpd.cgi of the component Password Handler. The manipulation of the argument routepwd leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
LB-LINKBL-AC36001.0.0affected
LB-LINKBL-AC36001.0.1affected
LB-LINKBL-AC36001.0.2affected
LB-LINKBL-AC36001.0.3affected
LB-LINKBL-AC36001.0.4affected
LB-LINKBL-AC36001.0.5affected
LB-LINKBL-AC36001.0.6affected
LB-LINKBL-AC36001.0.7affected
LB-LINKBL-AC36001.0.8affected
LB-LINKBL-AC36001.0.9affected
LB-LINKBL-AC36001.0.10affected
LB-LINKBL-AC36001.0.11affected
LB-LINKBL-AC36001.0.12affected
LB-LINKBL-AC36001.0.13affected
LB-LINKBL-AC36001.0.14affected
LB-LINKBL-AC36001.0.15affected
LB-LINKBL-AC36001.0.16affected
LB-LINKBL-AC36001.0.17affected
LB-LINKBL-AC36001.0.18affected
LB-LINKBL-AC36001.0.19affected
LB-LINKBL-AC36001.0.20affected
LB-LINKBL-AC36001.0.21affected
LB-LINKBL-AC36001.0.22affected

Weaknesses

  • CWE-77: Command Injection
  • CWE-74: Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References