Advisory Details

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within /cgi-bin/tools_usermanage.asp. The issue results from transmitting a list of users and their credentials to be handled on the client side. An attacker can leverage this vulnerability to disclose transported credentials, leading to further compromise.

12/06/24 – ZDI contacted the vendor’s support team via email
02/13/25 – ZDI requested an update
03/12/25 – ZDI informed the vendor that since we have not received a response, we will publish the report as a 0-day advisory

• 2025-03-11 - Vulnerability reported to vendor
• 2025-03-25 - Coordinated public release of advisory
• 2025-03-25 - Advisory Updated