PT-2025-39007 · Undefined · Undefined

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57685

Mitre

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The LB-Link routers, including the BL-AC2100 AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000 AE4 v2.4.9, BL-AC1900 AZ2 v1.0.2, BL-X26 AC8 v1.2.8, and BL-LTE300 DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set serial cfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-57685

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-57685 · Security Note
• https://b-link.net.cn · Note
• https://github.com/mono7s/LB-Link/blob/main/bs_SetSerial.md · Note
• http://bl-ac2100.com · Note