CVE-2025-7564
LB-LINK BL-AC3600 shadow hard-coded credentials
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Eine kritische Schwachstelle wurde in LB-LINK BL-AC3600 1.0.22 entdeckt. Dies betrifft einen unbekannten Teil der Datei /etc/shadow. Dank Manipulation mit der Eingabe root:blinkadmin mit unbekannten Daten kann eine hard-coded credentials-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2025-07-12 CVE Reserved
- 2025-07-14 CVE Published
- 2025-07-14 CVE Updated
- 2025-07-14 First Exploit
- 2025-07-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-259: Use of Hard-coded Password
- CWE-798: Use of Hard-coded Credentials
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md | Related | |
| https://vuldb.com/?id.316262 | Technical Description | |
| https://vuldb.com/?submit.605630 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md#poc | 2025-07-14 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|