The vulnerability of the reboot() and restore() functions in the /cgi-bin/lighttpd.cgi microprogramming system of LB-LINK routers allows a attacker to execute arbitrary code.

🗓️ 28 Jul 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

The reboot and restore flaws in LB-LINK router lighttpd.cgi enable remote arbitrary code execution due to weak authentication.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-7574	9 Sep 202520:51	–	circl
CNNVD	LB-LINK多款产品安全漏洞	14 Jul 202500:00	–	cnnvd
CVE	CVE-2025-7574	14 Jul 202505:02	–	cve
Cvelist	CVE-2025-7574 LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authentication	14 Jul 202505:02	–	cvelist
EUVD	EUVD-2025-21310	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7574	14 Jul 202505:15	–	nvd
Positive Technologies	PT-2025-29424 · Lb Link · Lb-Link Bl-Ac3600 +5	2 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-7574	16 Jul 202505:14	–	redhatcve
Vulnrichment	CVE-2025-7574 LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authentication	14 Jul 202505:02	–	vulnrichment

Vulners

Node

shenzhen_bilian_electronics_co.,lb-link_bl-wr9000Match2.4.9

OR

shenzhen_bilian_electronics_co.,lb-link_bl-ac1900Match1.0.2

OR

shenzhen_bilian_electronics_co.,lb-link_bl-ac2100_az3Match1.0.4

OR

shenzhen_bilian_electronics_co.,lb-link_bl-ax5400pMatch1.0.19

OR

shenzhen_bilian_electronics_co.,lb-link_bl-ax1800Match1.0.19

OR

shenzhen_bilian_electronics_co.,lb-link_bl-ac3600Match1.0.22

Source	Link
github	www.github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md
web	www.web.nvd.nist.gov/view/vuln/detail

28 Jul 2025 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 39.8

CVSS 210

EPSS0.00745

lighttpd CGI vulnerability reboot vulnerability restore vulnerability remote code execution authentication weakness lb link routers