CVE-2025-9576

A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Interface. The manipulation leads to use of default credentials. An attack has to be approached locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-1392

• https://github.com/XXRicardo/iot-cve/blob/main/seeedstudio/ramips-openwrt-LinkIt7688.mdExploit, Third Party Advisory
• https://github.com/XXRicardo/iot-cve/blob/main/seeedstudio/ramips-openwrt-LinkIt7688.md#steps-to-reproduceExploit, Third Party Advisory
• https://vuldb.com/?ctiid.321690Permissions Required, VDB Entry
• https://vuldb.com/?id.321690Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.636068Third Party Advisory, VDB Entry
• https://github.com/XXRicardo/iot-cve/blob/main/seeedstudio/ramips-openwrt-LinkIt7688.mdExploit, Third Party Advisory
• https://github.com/XXRicardo/iot-cve/blob/main/seeedstudio/ramips-openwrt-LinkIt7688.md#steps-to-reproduceExploit, Third Party Advisory

Published

Aug 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9570The eHRD CTMS developed by Sunnet has an Arbitrary File Read…6.9
• CVE-2025-9571A remote code execution (RCE) vulnerability exists in Google…8.7
• CVE-2025-9572n authorization flaw in Foreman's GraphQL API allows low-pri…6.5
• CVE-2025-9573The ns_backup extension through 13.0.2 for TYPO3 allows comm…8.6
• CVE-2025-9574Missing Authentication for Critical Function vulnerability i…10
• CVE-2025-9575A vulnerability was determined in Linksys RE6250, RE6300, RE…8.8
• CVE-2025-9577A security flaw has been discovered in TOTOLINK X2000R up to…7
• CVE-2025-9578Local privilege escalation due to insecure folder permission…7.8
• CVE-2025-9579A weakness has been identified in LB-LINK BL-X26 1.2.8. The …8.8
• CVE-2025-9580A security vulnerability has been detected in LB-LINK BL-X26…8.8
• CVE-2025-9581A vulnerability was detected in Comfast CF-N1 2.6.0. This im…9.8
• CVE-2025-9582A flaw has been found in Comfast CF-N1 2.6.0. Affected is th…9.8