What is CVE-2025-2772?

CVE-2025-2772 is a medium-severity vulnerability in Bec Technologies Multiple Routers, classified under Insufficiently Protected Credentials. CVSS score: 6.5/10. Published 2025-04-23.

How severe is CVE-2025-2772?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Bec Technologies Multiple Routers

CVE-2025-2772

BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within /cgi-bin/tools_usermanage.asp. The issue results from transmitting a list of users and their credentials to be handled on the client side. An attacker can leverage this vulnerability to disclose transported credentials, leading to further compromise. Was ZDI-CAN-25895.

EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Bec Technologies Multiple Routers — versions 1.04.1.512, 1.04.1.542
Bectechnologies Router_firmware

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2025-2772?: CVE-2025-2772 is a medium-severity vulnerability in Bec Technologies Multiple Routers, classified under Insufficiently Protected Credentials. CVSS score: 6.5/10. Published 2025-04-23.
How severe is CVE-2025-2772?: Medium severity. CVSS v3 base score is 6.5 out of 10.