LB-LINK BL-AC3600 Web Management Interface Password Information Disclosure Vulnerability

A critical vulnerability has been identified in the LB-LINK BL-AC3600 router, affecting versions through 1.0.22. The issue resides in the Web Management Interface, specifically within the function 'geteasycfg' of the file '/cgi-bin/lighttpd.cgi'. This vulnerability allows for the unauthorized disclosure of plaintext admin passwords. The exploitation can be initiated remotely, without the need for authentication.

Impact

Exploitation of this vulnerability allows attackers to obtain the admin password in plaintext, potentially leading to full control over the affected device.

Reproduction

To reproduce this vulnerability, send an HTTP request to the '/cgi-bin/lighttpd.cgi' endpoint with the 'type' parameter set to 'geteasycfg'. The response will include the admin password in plaintext.

Remediation

It is recommended to apply restrictive firewalling to mitigate this vulnerability.