CVE-2025-2770 BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability
Authenticated attackers can retrieve cleartext credentials from BEC Technologies routers via the web interface, enabling further compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2770?
CVE-2025-2770 is a medium-severity vulnerability in BEC Technologies Multiple Routers, published on 23 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web-based user interface. The issue results from storing credentials in a recoverable format. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25986.
Which versions are affected by CVE-2025-2770?
It affects 1 product.
Products include Bectechnologies Router Firmware.
How do I fix CVE-2025-2770?
No fix has been published for CVE-2025-2770 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2770 being exploited?
There is no known exploitation of CVE-2025-2770 in the wild and no public exploit code.
Other vulnerabilities in BEC Technologies Multiple Routers
- CVE-2025-2773 BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability
- CVE-2025-2771 BEC Technologies Multiple Routers Authentication Bypass Vulnerability
- CVE-2025-2772 BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability
Sources
Also known as GHSA-4vrp-pmwp-p4h4.