CVE-2025-9576
BaseFortify
Publication date: 2025-08-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| seeedstudio | linkit_smart_7688_firmware | * |
| seeedstudio | linkit_smart_7688 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the seeedstudio ReSpeaker LinkIt7688 device, specifically its Administrative Interface related to the /etc/shadow file. The issue is that the device uses default credentials with a weak password for the root user account, stored using weak MD5-crypt hashing. This allows attackers with local access to potentially gain unauthorized root access by exploiting these default credentials. The exploit is publicly available but requires a high degree of complexity and local access to the device. [1, 2]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to unauthorized root access to the affected device, compromising its confidentiality. Since the root password is weak and stored insecurely, an attacker with local access could take control of the device, potentially leading to unauthorized administrative actions. However, remote exploitation is not feasible, and the attack requires significant complexity and local access. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the /etc/shadow file on the seeedstudio ReSpeaker LinkIt7688 device for default or weak credentials, specifically the root account password hashed with MD5-crypt. Using password cracking tools like John the Ripper against the /etc/shadow file can reveal if the default weak password "root" is in use. Commands to extract and test the password hash include: 1) Access the device locally and copy the /etc/shadow file: `cat /etc/shadow` 2) Use John the Ripper to crack the password hash: `john /etc/shadow` This will help identify if the default credentials are still active. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected seeedstudio ReSpeaker LinkIt7688 device with an alternative solution, as no official patches or countermeasures have been released. Since the vulnerability requires local access and involves default credentials, restricting physical and local access to the device is critical. Additionally, changing default passwords if possible and disabling or securing the administrative interface can help reduce risk, but the recommended action is to replace the vulnerable product. [2]