CVE-2025-10773
📋 TL;DR
A stack-based buffer overflow vulnerability in the B-Link BL-AC2100 router's web management interface allows remote attackers to execute arbitrary code. This affects all versions up to 1.0.3. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- B-Link BL-AC2100
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral network movement, and persistent backdoor installation.
Likely Case
Router takeover allowing traffic interception, DNS manipulation, credential theft, and denial of service.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access and network segmentation.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the router's web management interface to prevent remote exploitation
Access router CLI via SSH/Telnet
Navigate to web interface settings
Disable web management or restrict to local network only
Network Access Control
linuxRestrict access to router management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Segment network to isolate router from critical systems
- Implement strict firewall rules blocking all external access to router management ports (80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://router-ip/status.asp or via SSH using 'cat /proc/version'Check Version:
curl -s http://router-ip/status.asp | grep -i versionVerify Fix Applied:
No official fix available. Verify workarounds by testing that web interface is inaccessible from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/set_delshrpath_cfg
- Multiple failed buffer overflow attempts in web server logs
- Unexpected process crashes or restarts
Network Indicators:
- Unusual traffic patterns to router management ports from external IPs
- POST requests with overly long Type parameter values
SIEM Query:
source="router_logs" AND (url="/goform/set_delshrpath_cfg" OR message="buffer overflow")