EUVD-2026-85713
GHSA-48fm-24x4-p42q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management interface over network
-
ExploitRequest Mifi_config.bin backup endpoint
-
ExecutionHandler returns config without auth
-
ImpactExtract device settings/credentials from backup
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the device's Configuration Backup Handler (the Mifi_config.bin endpoint) on an LB-Link BL-CPE600EU running firmware 5.8.13 - no authentication, no user interaction, and no non-default configuration are needed per PR:N/UI:N/AC:L. The primary LIMITING factor is exposure: the management interface must be reachable by the attacker, so devices behind NAT or with WAN-side management disabled are not remotely exploitable from the internet, confining most realistic attacks to LAN-adjacent or internet-exposed CPE units. The affected scope is narrow - a single firmware version of one obscure SOHO/CPE product with no vendor patch available. |
| Impact | This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivially reachable, unauthenticated, low-complexity remote access, and the confidentiality-only impact is scored VC:L with VI:N/VA:N - consistent with an information-disclosure flaw rather than a compromise primitive. The vendor score of 6.9 is inflated by VulDB's typical scoring; the actual real-world stakes hinge on WHAT the Mifi_config.bin backup contains - if it exposes plaintext admin/Wi-Fi/PPPoE credentials, effective confidentiality is closer to C:H (my assessment ~5.3, rising if creds are embedded). The 'E:P' temporal metric plus the VulDB submission confirm publicly available exploit code exists, but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. Aggravating the picture: the vendor was contacted and did not respond, so no patch is expected. Net: a real, easily-exploited unauth info leak on an obscure SOHO CPE device, meaningful for exposed devices but not a fleet-wide emergency given the narrow product footprint. |
| Exploit ScenarioDerived | An attacker who can reach the device's web/management interface over the network requests the Configuration Backup Handler and downloads Mifi_config.bin without authenticating, obtaining the device configuration (potentially including credentials and network settings). Public exploit code has been released (VulDB, E:P), lowering the skill bar. Because the CVSS vector is AV:N/PR:N/AC:L, this requires only network reachability to the management endpoint and no special conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated remote retrieval of the Mifi_config.bin configuration backup from an LB-Link BL-CPE600EU running firmware 5.8.13 exposes stored device settings and credentials to anyone who can reach the device's management interface, an information-disclosure weakness (CWE-200) rooted in the Configuration Backup Handler's lack of access control. Exploitation requires only network reachability to the affected endpoint - no credentials, user interaction, or non-default configuration - but the real-world exposure window is narrow because NAT-bound units and devices with WAN-side management disabled cannot be reached from the internet, leaving LAN-adjacent or deliberately internet-exposed CPE units as the practical targets. Publicly available exploit code exists for this CVE, and the vendor was contacted but never responded, so no vendor-released patch has been identified at time of analysis; our independent assessment classifies this as a genuine but low-to-moderate priority issue rather than an urgent one.
RemediationAI
No vendor-released patch identified at time of analysis: LB-Link was contacted early about this disclosure and did not respond, and the available references (https://vuldb.com/vuln/408973 and https://vuldb.com/vuln/408973/cti) contain no fixed firmware version, so there is no exact upgrade target to cite. Because the decision must therefore be compensating controls, prioritize reducing reachability of the Configuration Backup Handler: disable WAN-side/remote web management so the management interface is bound to the LAN only, and block inbound TCP/HTTP and TCP/HTTPS to the CPE from the internet at the upstream router or provider edge - this defeats all internet-based exploitation at the cost of losing remote administration until you can manage the device via VPN or the LAN. Within the LAN, restrict access to the web UI to a small administrative subnet or an allow-listed set of management hosts via firewall rules, and segment IoT/CPE devices onto their own VLAN so that an attacker who already has a LAN foothold cannot trivially reach the backup endpoint; the trade-off is additional network complexity and the need to maintain ACLs as the management station set changes. If the device supports it, change default administrative credentials and, more importantly, rotate the Wi-Fi PSK, APN/SIM-related secrets, and any administrator passwords that may already have been captured via the exposed Mifi_config.bin, since a backup file is a credential-disclosure event even after the endpoint is locked down. Monitor for anomalous GET requests to the Mifi_config.bin path or for repeated unauthenticated access to the web management interface, and if the vendor later publishes firmware (check the VulDB entry and the LB-Link support page periodically), apply it immediately. There are no non-breaking workarounds that preserve full remote-management functionality - every practical mitigation here trades away some degree of remote access, and for a device that cannot be patched or firewalled, replacement should be considered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The LB-Link BL-CPE600EU is a small-office/home-office MiFi/CPE router whose web management stack includes a Configuration Backup Handler that serves the Mifi_config.bin file to administrators for backup and restore purposes. The reported flaw maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the handler fails to enforce an authorization check before disclosing the backup archive, which typically contains Wi-Fi pre-shared keys, APN and SIM-related settings, administrative credentials, and other network configuration that an attacker can reuse to pivot onto the local network or hijack the device. The CVSS v4.0 vector provided in the source data (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) aligns with the independent CVSS v3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) in describing a network-reachable, unauthenticated, low-confidentiality-impact disclosure with no integrity or availability effect and no scope change. The CPE record cpe:2.3:a:lb-link:bl-cpe600eu:*:*:*:*:*:*:*:* uses a wildcard version, which is the vendor's convention for this product line rather than proof that every build is vulnerable; the reported and confirmed-affected build is firmware 5.8.13. Because the underlying issue is a missing/weak access-control decision in the firmware's HTTP handling rather than a memory-safety bug, mitigation generally comes down to firmware replacement or network-level reachability control rather than input sanitization. The 'E:P' (Proof-of-Concept) exploit maturity metric in the v4.0 vector corroborates the advisory's statement that exploit code has been published. No CISA KEV entry, EPSS score, or patch reference was supplied with the intelligence feed, so the analysis rests on the VulDB-derived advisory, the wildcard CPE, and the independent reachability analysis.
Know when Bl Cpe600Eu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated remote low-complexity access (AV:N/AC:L/PR:N/UI:N); confidentiality-only leak scored C:L conservatively as the backup's contents are unspecified - C:H if plaintext credentials are confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB