LB-LINK BL-AC3600 EUVD-2025-21303

Attacker must already possess low-privilege authenticated access to the router's underlying Linux system (PR:L in CVSS vector), typically achieved through one of these vectors: (1) compromised web administration panel credentials granting shell access, (2) physical access to device serial/UART debug ports, (3) exploitation of a separate remote code execution vulnerability providing initial shell foothold, or (4) firmware extraction and modification in supply chain attacks. The vulnerability itself requires no special configuration - the hardcoded credentials exist in default firmware 1.0.22 regardless of user settings. The local attack vector (AV:L) significantly limits remote exploitation; attackers cannot directly leverage this from the internet without first breaching the router through another means. This hard-coded credential becomes exploitable only after initial device access is obtained, but then enables complete escalation from any user-level access to root.

Real-world risk is moderate but contextually severe for affected deployments. CVSS 7.1 (High) reflects complete device compromise potential, while EPSS 0.03% (6th percentile) indicates minimal widespread exploitation activity, likely due to the local attack vector (AV:L) requiring prior device access. However, the attack complexity is low (AC:L) and publicly available exploit code exists (E:P in CVSS vector, confirmed via GitHub POC), lowering the barrier for motivated attackers. The critical factor limiting broader impact is PR:L (low privileges required) - an attacker needs existing authenticated access, either through compromised admin credentials, physical device access, or exploitation of another vulnerability granting shell access. For SOHO and home networks, this is HIGH risk: if an attacker gains any foothold (phishing, default credentials on admin panel, physical access), they achieve full router control, enabling persistent backdoors, traffic interception, and lateral movement. The vendor's non-response to disclosure eliminates prospects for an official patch, leaving devices permanently vulnerable. Prioritize replacement over remediation for security-sensitive deployments. No KEV listing suggests no mass exploitation campaigns, but the authentication bypass tag and public POC make this attractive for targeted attacks against high-value home/small office networks.

An attacker first gains low-privilege access to the router through compromised web admin credentials (obtained via phishing or brute-forcing default passwords) or physical access to the device's debug serial port. With shell access established, the attacker reads /etc/shadow and discovers the hardcoded 'root:blinkadmin' credentials documented in the public POC. They execute 'su root' with password 'blinkadmin', instantly escalating to root privileges with full firmware modification capabilities, allowing installation of persistent backdoors, DNS hijacking, or using the router as a pivot point for attacking connected devices on the LAN.