The flaw exists in the Configuration Backup Handler component of LB-Link BL-CPE600EU firmware 5.8.13, where manipulating the Mifi_config.bin file can cause sensitive configuration data to be exposed. The vulnerability is a classic information disclosure (CWE‑200) that also involves improper authorization controls (CWE‑284). An attacker who can send crafted input to the handler can read confidential backup files, thereby compromising the confidentiality of device settings and potentially enabling further attacks. The CVSS score of 6.9 indicates a moderate level of severity.

Affected is the LB-Link BL‑CPE600EU device running firmware 5.8.13. Other versions or models have not been confirmed to be impacted, and no broader product scope is indicated in the CNA data.

The attack can be performed remotely, and the exploit code has already been published publicly. Because EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation cannot be precisely quantified, but the existence of public exploit code suggests it is within reach of determined attackers. The moderate CVSS score combined with remote access capability and lack of vendor response elevates the practical risk for organizations still using the affected firmware. Prompt remediation is advised.