CVE-2025-57278

The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or verifying client identity. There are no session tokens, cookies, or unique identifiers in place. This flaw allows an attacker to obtain full administrative access simply by configuring their device to use the same IP address as a previously authenticated user. This results in a complete authentication bypass.

• CWE-287

• https://www.lb-link.com/CPE300M-AX300-4G-LTE-Router-pd502775568.htmlProduct
• https://www.zyenra.com/blog/improper-ip-bound-session-authentication-in-lb-link-cpe300mExploit, Third Party Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57254An SQL injection vulnerability in user-login.php and index.p…6.5
• CVE-2025-5726A vulnerability was found in SourceCodester Student Result M…5.4
• CVE-2025-57263An authenticated SQL injection vulnerability in VX Guestbook…7.2
• CVE-2025-57266An issue was discovered in file AssistantController.java in …9.8
• CVE-2025-5727A vulnerability classified as problematic has been found in …5.4
• CVE-2025-57275Storage Performance Development Kit (SPDK) 25.05 is vulnerab…5.5
• CVE-2025-5728A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2025-57282ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injec…8.8
• CVE-2025-57283The Node.js package browserstack-local 1.5.8 contains a comm…7.8
• CVE-2025-57285codeceptjs 3.7.3 contains a command injection vulnerability …9.8
• CVE-2025-5729A vulnerability, which was classified as critical, was found…7.5
• CVE-2025-57292Todoist v8484 contains a stored cross-site scripting (XSS) v…6.1