| 标题 | LB-Link CPE600EU V5.8.13 Information Disclosure |
|---|
| 描述 | LB-Link CPE600EU firmware V5.8.13 contains an unauthenticated information disclosure vulnerability. The router exposes an undocumented configuration backup endpoint that can be accessed without authentication from the local network.
A remote attacker with network access to the router's web management interface can send an HTTP GET request to the endpoint:
GET /.s3cfg HTTP/1.1
Host: <router-ip>
or:
curl http://<router-ip>/.s3cfg
The router responds with HTTP 200 OK and returns a downloadable configuration backup (e.g., Mifi_config.bin) without requiring authentication or a valid session.
Analysis of the downloaded configuration file shows that it contains sensitive information including:
Administrator credentials (or password hashes)
Wi-Fi SSID and WPA/WPA2 pre-shared key
IMEI
IMSI
ICCID
APN configuration
DHCP/DNS configuration
Connected device information
Additional router configuration parameters
The vulnerability was confirmed on firmware V5.8.13, which was supplied by the vendor as the latest available firmware. The vendor was notified before this submission, and the issue remains reproducible. |
|---|
| 用户 | dakshana (UID 100043) |
|---|
| 提交 | 2026-07-22 07時45分 (2 月前) |
|---|
| 管理 | 2026-09-23 15時58分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408973 [LB-Link BL-CPE600EU 5.8.13 Configuration Backup Mifi_config.bin 信息公开] |
|---|
| 积分 | 17 |
|---|