LB-LINK BL-WR9000 Web Interface lighttpd.cgi 恢复时身份验证不当

The vulnerability resides in the reboot/restore function of the /cgi-bin/lighttpd.cgi file within the Web Interface. An attacker can manipulate this function to bypass authentication mechanisms. Successful exploitation grants unauthorized access to the router's configuration and management interface. This could lead to complete control of the device, including modification of network settings, data interception, and potential use as a pivot point for further attacks on the internal network. The public disclosure of this exploit significantly increases the risk of widespread exploitation.

Small and medium-sized businesses (SMBs) and home users relying on LB-LINK routers are at significant risk. Shared hosting environments utilizing these routers are particularly vulnerable due to the potential for widespread compromise. Users with legacy router configurations or those who have not updated their devices in a long time are also at increased risk.

• windows / supply-chain: Monitor PowerShell execution for commands related to network configuration changes or attempts to access router interfaces. Check scheduled tasks for suspicious entries. • linux / server: Monitor system logs (journalctl) for authentication failures or unusual activity on the router's web interface. Use ss or lsof to identify connections to port 80 or 443 from unexpected sources. • generic web: Use curl to probe the /cgi-bin/lighttpd.cgi endpoint and examine the response headers for any anomalies. Review access and error logs for suspicious requests.

1. 2025-07-14Disclosure

   disclosure

2. 2025-07-14Patch

   patch

1. 已保留2025-07-13
2. 发布日期2025-07-14
3. EPSS 更新日期2026-03-23

The primary mitigation is to immediately upgrade affected LB-LINK routers to version 20250702.0.1 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While a direct WAF rule targeting the /cgi-bin/lighttpd.cgi endpoint is difficult without specific exploit patterns, restricting access to this endpoint from untrusted networks can reduce the attack surface. Monitor router logs for unusual activity or authentication attempts. After upgrading, confirm the fix by attempting to access the router's web interface with invalid credentials; authentication should be denied.