Vulnerability · Published Apr 23, 2025 · Assigned by zdi

CVE-2025-2772BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability

Medium 5.3

In plain English

A medium-severity security flaw in Multiple Routers from BEC Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.5%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within /cgi-bin/tools_usermanage.asp. The issue results from transmitting a list of users and their credentials to be handled on the client side. An attacker can leverage this vulnerability to disclose transported credentials, leading to further compromise. Was ZDI-CAN-25895.

Affected products (as reported)

Vendor	Product	Versions
BEC Technologies	Multiple Routers	1.04.1.512, 1.04.1.542

Weakness: CWE-522 · Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ZDI-25-185 x_research-advisory