A critical session validation vulnerability in the Shenzhen Zhibotong Electronics ZBT WE2001 router allows unauthenticated remote attackers to extract sensitive configuration data and credentials.

This vulnerability involves a lack of session validation in the web API component, specifically affecting get_* operations. It permits unauthenticated remote attackers to bypass access controls and retrieve administrative information, including plaintext credentials, without a valid session.

Successful exploitation of this vulnerability poses a severe risk to organizational security, as the exposure of administrative credentials can lead to total device compromise. With access to device configurations, an attacker can manipulate network traffic, intercept sensitive data, or establish a persistent foothold within the local network. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to prevent unauthorized access to critical infrastructure.

Immediate Action: Since a specific patch is currently unknown, isolate the affected ZBT WE2001 devices from the public internet immediately to prevent remote exploitation.

Proactive Monitoring: Review device access logs for unusual patterns of API calls, particularly those involving get_* operations originating from unauthorized or unknown IP addresses.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the device management interface to trusted, internal IP ranges only.

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up referenced by the CVE record (neutsec.io/advisories/cve-2025-65127).

The exposure of plaintext credentials via an unauthenticated API call represents a significant security failure that must be addressed with urgency. Administrators should prioritize network-level isolation of these devices while awaiting further guidance or firmware updates from the vendor, as this remains the most effective method to neutralize the risk of unauthorized information disclosure.