VulnerabilityAnalyzed

CVE-2025-2772

BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability.

MEDIUM 6.5EPSS 0.43%

Does this matter?

Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.

Description

BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within /cgi-bin/tools_usermanage.asp. The issue results from transmitting a list of users and their credentials to be handled on the client side. An attacker can leverage this vulnerability to disclose transported credentials, leading to further compromise. Was ZDI-CAN-25895.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.43% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-522
Affected: bectechnologies/router firmware
Source: zdi-disclosures@trendmicro.com

References

https://www.zerodayinitiative.com/advisories/ZDI-25-185/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.