PT-2026-4912 · Pix Link · Pix-Link Lv-Wr21Q

Wojciech Cybowski · Published 2026-01-27 · Updated 2026-01-31 · CVE-2025-12386

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pix-Link LV-WR21Q version V108 108 Pix-Link LV-WR21Q (affected versions not specified)

Description The Pix-Link LV-WR21Q device does not require authentication for the /goform/getHomePageInfo API endpoint. This allows a remote, unauthenticated attacker to access the endpoint and potentially retrieve the cleartext password for the access point. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges.

Recommendations Apply a patch or update to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-02479

CVE-2025-12386

Affected Products

Pix-Link Lv-Wr21Q

References · 9

• 🔥 https://github.com/wcyb/security_research · Exploit
• https://bdu.fstec.ru/vul/2026-02479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12386 · Security Note
• https://twitter.com/VulmonFeeds/status/2016210177536508396 · Twitter Post
• https://t.me/cveNotify/149976 · Telegram Post
• https://cert.pl/en/posts/2026/01/CVE-2025-12386 · Note
• https://twitter.com/CVEnew/status/2016128325505478771 · Twitter Post
• https://t.me/cveNotify/149975 · Telegram Post
• https://pix-link.com/lv-wr21q · Note