CVE-2025-7564
📋 TL;DR
This CVE discloses hard-coded credentials (root:blinkadmin) in the /etc/shadow file of LB-LINK BL-AC3600 routers. Attackers with local access can gain root privileges on affected devices. Users of LB-LINK BL-AC3600 routers running version 1.0.22 are affected.
💻 Affected Systems
- LB-LINK BL-AC3600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root access, allowing attackers to intercept traffic, modify configurations, install malware, or pivot to internal networks.
Likely Case
Local attackers gaining administrative control of the router to monitor network traffic, change DNS settings, or disable security features.
If Mitigated
Limited impact if proper network segmentation isolates the router and restricts local access to trusted users only.
🎯 Exploit Status
Exploit requires local access to the device. Public proof-of-concept demonstrates credential usage.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact vendor for updated firmware or consider replacing affected devices.
🔧 Temporary Workarounds
Change root password
linuxManually change the root password on affected routers to remove hard-coded credentials.
passwd root
Restrict local access
allImplement network controls to limit physical and network access to router management interfaces.
🧯 If You Can't Patch
- Isolate affected routers in a dedicated network segment with strict access controls.
- Monitor for unauthorized access attempts and implement multi-factor authentication for management interfaces.
🔍 How to Verify
Check if Vulnerable:
Check /etc/shadow file for the entry 'root:blinkadmin' on LB-LINK BL-AC3600 routers.Check Version:
Check router web interface or firmware version through admin panel.Verify Fix Applied:
Verify the root password has been changed by attempting to log in with 'blinkadmin' (should fail) and checking /etc/shadow no longer contains the hard-coded hash.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful root login
- Unauthorized configuration changes
Network Indicators:
- Unusual outbound connections from router
- DNS hijacking patterns
SIEM Query:
Example: 'source="router" AND (event="authentication success" AND user="root")'🔗 References
- https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md
- https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md#poc
- https://vuldb.com/?ctiid.316262
- https://vuldb.com/?id.316262
- https://vuldb.com/?submit.605630
- https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md
- https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md#poc
