CVE-2025-4076 in BL-AC3600
Summary
by MITRE • 04/29/2025
A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cgi-bin/lighttpd.cgi of the component Password Handler. The manipulation of the argument routepwd leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/10/2026
This critical vulnerability exists in the LB-LINK BL-AC3600 router firmware version 1.0.22 and earlier, specifically within the password handler component accessible through the /cgi-bin/lighttpd.cgi script. The flaw resides in the easy_uci_set_option_string_0 function where the routepwd parameter is processed without adequate input validation or sanitization. This allows an attacker to inject malicious commands through the routepwd argument, creating a command injection vulnerability that can be exploited remotely without requiring authentication. The vulnerability stems from improper handling of user-supplied input in a web interface component that should never directly execute system commands based on untrusted data sources.
The technical implementation of this vulnerability demonstrates a classic command injection flaw where the application fails to properly escape or validate the routepwd parameter before incorporating it into system commands. This type of vulnerability typically maps to CWE-77 Command Injection, which is categorized under the broader weakness of inadequate input validation. The attack vector is particularly dangerous because it operates over the network without requiring authentication, making it accessible to any remote attacker who can reach the device's web interface. The fact that the exploit has been publicly disclosed and is available for use significantly increases the risk profile, as it eliminates the need for advanced exploitation techniques.
The operational impact of this vulnerability is severe and potentially catastrophic for affected users. An attacker could execute arbitrary commands on the router with the privileges of the web server process, which typically runs with elevated privileges on the device. This could enable complete system compromise, allowing unauthorized access to network configurations, potential lateral movement within the network, and the ability to establish persistent backdoors. The vulnerability affects the core network infrastructure component, potentially enabling attackers to disrupt network services, monitor traffic, or use the device as a pivot point for attacking other systems within the local network. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically focusing on the execution of system commands through web interfaces.
Organizations and individuals using affected LB-LINK BL-AC3600 devices should immediately implement mitigations to protect against exploitation. The primary remediation involves updating to the latest firmware version from the vendor, although the lack of vendor response to early disclosure indicates a potential delay in patch availability. Network segmentation and firewall rules should be implemented to restrict access to the device's web interface from untrusted networks, while monitoring for suspicious network traffic patterns that might indicate exploitation attempts. Additionally, administrators should consider disabling unnecessary web services and implementing network access controls to limit exposure. The vulnerability also highlights the importance of secure coding practices and proper input validation, particularly for components that handle user data and interact with system-level functions. Given the public availability of the exploit, immediate action is required to protect network infrastructure from potential compromise.