Improper authentication in BEC Technologies Multiple Routers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25894.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BEC Technologies | Multiple Routers | 1.04.1.512, 1.04.1.542 | — | No fix listed | CNA |
- Multiple Routers VendorBEC Technologies Affected 1.04.1.512, 1.04.1.542 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bectechnologies:router_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | BEC Technologies |
- cpe:2.3:o:bectechnologies:router_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·BEC Technologies
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2771
- 2026-10-03 Alias added: GHSA-2j46-43q5-rfcp
References
Advisory 1
More BEC Technologies Router Firmware vulnerabilities
- TI-2025-02425 OS command injection in BEC Technologies Multiple Routers CVSS 3.0HIGH 7.2
- TI-2025-02424 Insufficiently protected credentials in BEC Technologies Multiple Routers CVSS 3.1MEDIUM 6.5
- TI-2025-02422 Cleartext storage of sensitive information in BEC Technologies Multiple Routers CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-2771 · CVE Program
- CVE-2025-2771 · NVD
- FIRST EPSS
- GHSA-2j46-43q5-rfcp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences