CVE-2025-57278

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or verifying client identity. There are no session tokens, cookies, or unique identifiers in place. This flaw allows an attacker to obtain full administrative access simply by configuring their device to use the same IP address as a previously authenticated user. This results in a complete authentication bypass.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-57288.8A vulnerability classified as critical was found in SourceCodester Open Source Clinic Management System 1.0. This vulnerability affects unkn CVE-2025-572828.8ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.CVE-2025-572837.8The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not pro CVE-2025-572859.8codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concat CVE-2025-57297.5A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected i CVE-2025-572926.1Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to proper CVE-2025-572938.8A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function i CVE-2025-572958.0H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user a CVE-2025-572966.5Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to th CVE-2025-57304.3The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege u CVE-2025-573056.5VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.CVE-2025-57315.5A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and inc