Submeter #873139: LB-LINK WR1210M V3.0 Firmware V1.0.3 Missing Authentication

A vulnerability was identified in LB-LINK WR1210M V3.0 (Firmware V1.0.3). The backup.cgi endpoint in the web management interface does not implement authentication verification. An adjacent network attacker can send a single unauthenticated HTTP GET request to /cgi-bin/backup.cgi to trigger a full system configuration backup via the sysupgrade -b command and download the resulting archive.

The backup archive contains highly sensitive data in plaintext including: administrator username and password (stored in /etc/config/blinkap admin_name and admin_pwd), the set_cmd_key secret (which enables root-level command execution through the setcmd API endpoint), WiFi SSID and WPA/WPA2 pre-shared keys, TR-069 ACS credentials (used by ISPs for remote management via easycwmpd), and SSH host keys.

Root Cause Analysis: Static analysis of the backup.cgi MIPS ELF binary reveals the binary does not import or call the check_auth() function from the shared library libblinkapi.so. Other CGI binaries on the same device (such as login.cgi, network.cgi, wireless.cgi) all invoke check_auth() to validate session cookies before processing requests. The backup.cgi binary omits this critical authentication step entirely.

Attack Vector: Adjacent Network (AV:A). The web management interface (lighttpd on port 80) is accessible from the LAN/WiFi side by default. The firewall WAN zone is configured with input REJECT, so this vulnerability is not directly exploitable from the Internet unless the user explicitly enables Remote Web Management.

Impact: The leaked set_cmd_key enables a complete attack chain. An attacker can steal the backup, extract admin credentials and the set_cmd_key, authenticate using the stolen credentials, then execute arbitrary OS commands as root via the /cgi-bin/setcmd endpoint. This effectively results in unauthenticated remote code execution from the adjacent network.

Affected Component: /cgi-bin/backup.cgi (MIPS32 ELF binary, MD5: can be verified from firmware image)
Affected File: /www/cgi-bin/backup.cgi
Affected Function: main() - missing call to check_auth()

CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1 Score: 6.5 (Medium)

Note: When chained with the setcmd RCE endpoint using the stolen set_cmd_key, the effective impact becomes CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8 (High).

PoC: curl -s "http://192.168.16.1/cgi-bin/backup.cgi" -o backup_raw.bin && dd if=backup_raw.bin bs=1 skip=32 of=backup.tar.gz

The vendor (LB-LINK / Shenzhen Liandian Communication Technology Co., Ltd.) was contacted multiple times but has not responded. No security contact or vulnerability disclosure program exists.

• Utilizador: m1nkvpm (UID 98237)
• Submissão: 29/06/2026 15h14 (há 2 meses)
• Moderação: 16/08/2026 09h58 (2 months later)
• Estado: Aceite
• Entrada VulDB: 391148 [LB-Link WR1210M 1.0.3 Backup Endpoint /www/cgi-bin/backup.cgi main Autenticação fraca]
• Pontos: 17