CVE-2025-7565 | LB-LINK BL-AC3600 up to 1.0.22 Web Management Interface /cgi-bin/lighttpd.cgi geteasycfg Password information disclosure

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure.

This vulnerability is uniquely identified as CVE-2025-7565. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

It is recommended to apply restrictive firewalling.

The vendor was contacted early about this disclosure but did not respond in any way.