PT-2025-25404 · Blink · Bl-Ac2100 Az3+8

Published

2025-06-13

·

Updated

2025-07-10

·

CVE-2025-45984

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Blink routers BL-WR9000 version 2.4.9 Blink routers BL-AC1900 version 1.0.2 Blink routers BL-AC2100 AZ3 version 1.0.4 Blink routers BL-X10 AC8 version 1.0.5 Blink routers BL-LTE300 version 1.2.3 Blink routers BL-F1200 AT1 version 1.0.0 Blink routers BL-X26 AC8 version 1.2.8 Blink routers BLAC450M AE4 version 4.0.0 Blink routers BL-X26 DA3 version 1.2.7
Description The issue is related to a command injection vulnerability. This vulnerability occurs via the routepwd parameter in the sub 45B238 function.
Recommendations For BL-WR9000 version 2.4.9, consider disabling the sub 45B238 function until a patch is available. For BL-AC1900 version 1.0.2, restrict access to the routepwd parameter in the affected function to minimize the risk of exploitation. For BL-AC2100 AZ3 version 1.0.4, avoid using the routepwd parameter in the sub 45B238 function until the issue is resolved. For BL-X10 AC8 version 1.0.5, temporarily disable the sub 45B238 function to prevent potential exploitation. For BL-LTE300 version 1.2.3, restrict the use of the routepwd parameter to authorized personnel only. For BL-F1200 AT1 version 1.0.0, consider applying configuration changes to limit the impact of the vulnerability. For BL-X26 AC8 version 1.2.8, disable the sub 45B238 function as a temporary workaround. For BLAC450M AE4 version 4.0.0, avoid using the affected function until a fix is available. For BL-X26 DA3 version 1.2.7, restrict access to the vulnerable parameter to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-45984

Affected Products

Bl-Ac1900
Bl-Ac2100 Az3
Bl-F1200 At1
Bl-Lte300
Bl-Wr9000
Bl-X10 Ac8
Bl-X26 Ac8
Bl-X26 Da3
Blac450M Ae4