| शीर्षक | LB-Link CPE600EU V5.8.13 Information Disclosure |
|---|
| विवरण | LB-Link CPE600EU firmware V5.8.13 contains an unauthenticated information disclosure vulnerability. The router exposes an undocumented configuration backup endpoint that can be accessed without authentication from the local network.
A remote attacker with network access to the router's web management interface can send an HTTP GET request to the endpoint:
GET /.s3cfg HTTP/1.1
Host: <router-ip>
or:
curl http://<router-ip>/.s3cfg
The router responds with HTTP 200 OK and returns a downloadable configuration backup (e.g., Mifi_config.bin) without requiring authentication or a valid session.
Analysis of the downloaded configuration file shows that it contains sensitive information including:
Administrator credentials (or password hashes)
Wi-Fi SSID and WPA/WPA2 pre-shared key
IMEI
IMSI
ICCID
APN configuration
DHCP/DNS configuration
Connected device information
Additional router configuration parameters
The vulnerability was confirmed on firmware V5.8.13, which was supplied by the vendor as the latest available firmware. The vendor was notified before this submission, and the issue remains reproducible. |
|---|
| उपयोगकर्ता | dakshana (UID 100043) |
|---|
| सबमिशन | 22/07/2026 07:45 AM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 03:58 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408973 [LB-Link BL-CPE600EU 5.8.13 Configuration Backup Mifi_config.bin सूचना का प्रकटीकरण] |
|---|
| अंक | 17 |
|---|