LB-LINK BL-AC3600 CVE-2025-7564

No vendor-released patch identified at time of analysis - LB-LINK did not respond to early disclosure attempts, indicating no official fix is forthcoming for firmware 1.0.22. Primary recommendation: replace affected BL-AC3600 routers with alternative vendors demonstrating active security support and update practices. For environments where immediate replacement is infeasible, implement compensating controls with significant operational trade-offs: (1) Disable all remote management interfaces (TR-069, cloud management, UPnP admin) to prevent remote attackers from leveraging other vulnerabilities to gain the required local shell access - this breaks remote support capabilities; (2) Enable MAC address filtering and restrict administrative access to known-good devices only - adds management overhead and can be bypassed via MAC spoofing by attackers with network access; (3) Deploy network segmentation placing the vulnerable router behind a hardened upstream firewall, limiting blast radius of compromise - requires additional hardware investment; (4) Monitor /etc/shadow file integrity and router process lists for unauthorized modifications, though attackers with root can disable monitoring. Reference the public disclosure at https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Hardcoded_Credentials_in_BL-AC3600_Routers.md for technical details. None of these mitigations address the root vulnerability; device replacement remains the only definitive solution.