CVE-2025-2772

🗓️ 23 Apr 2025 16:52:23Reported by zdiType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

BEC Technologies routers vulnerable to credential disclosure without authentication.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-2772	25 Mar 202504:00	–	circl
CNNVD	BEC Routers 安全漏洞	23 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-2772 BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability	23 Apr 202516:52	–	cvelist
EUVD	EUVD-2025-12171	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2772	23 Apr 202517:16	–	nvd
Positive Technologies	PT-2025-12848 · Bec Technologies · Bec Technologies Multiple Routers	25 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-2772	26 Apr 202503:21	–	redhatcve
Vulnrichment	CVE-2025-2772 BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability	23 Apr 202516:52	–	vulnrichment
Zero Day Initiative	(0Day) BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability	25 Mar 202500:00	–	zdi

NVD

Vulners

Node

bectechnologies router_firmwareMatch-

[
  {
    "vendor": "BEC Technologies",
    "product": "Multiple Routers",
    "versions": [
      {
        "version": "1.04.1.512, 1.04.1.542",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-25-185/

Parameter	Position	Path	Description	CWE
users	request body	/cgi-bin/tools_usermanage.asp	Insufficient protection of credentials during client-side handling leading to disclosure of user credentials via the affected endpoint.	CWE-522
credentials	request body	/cgi-bin/tools_usermanage.asp	Insufficient protection of credentials during client-side handling leading to disclosure of user credentials via the affected endpoint.	CWE-522
userlist	request body	/cgi-bin/tools_usermanage.asp	Insufficient protection of credentials during client-side handling leading to disclosure of user credentials via the affected endpoint.	CWE-522
passwords	request body	/cgi-bin/tools_usermanage.asp	Insufficient protection of credentials during client-side handling leading to disclosure of user credentials via the affected endpoint.	CWE-522
authentication tokens	request body	/cgi-bin/tools_usermanage.asp	Insufficient protection of credentials during client-side handling leading to disclosure of user credentials via the affected endpoint.	CWE-522

21 Aug 2025 00:37Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

CVSS 35.3

EPSS0.00167

SSVC

CWE-522