PT-2026-4912 · Pix Link · Pix-Link Lv-Wr21Q

Wojciech Cybowski · CVE-2025-12386 · Published 2026-01-27 · Updated 2026-01-31

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pix-Link LV-WR21Q version V108 108 Pix-Link LV-WR21Q (affected versions not specified)

Description The Pix-Link LV-WR21Q device does not require authentication for the /goform/getHomePageInfo API endpoint. This allows a remote, unauthenticated attacker to access the endpoint and potentially retrieve the cleartext password for the access point. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges.

Recommendations Apply a patch or update to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-306

CWE-754

Related Identifiers

BDU:2026-02479

BDU:2026-09000

CVE-2025-12386

Affected Products

Pix-Link Lv-Wr21Q

References · 11

• 🔥 https://github.com/wcyb/security_research · Exploit
• https://bdu.fstec.ru/vul/2026-02479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12386 · Security Note
• https://bdu.fstec.ru/vul/2026-09000 · Security Note
• https://github.com/wcyb/security_research?tab=readme-ov-file · Note
• https://twitter.com/VulmonFeeds/status/2016210177536508396 · Twitter Post
• https://cert.pl/en/posts/2026/01/CVE-2025-12386 · Note
• https://twitter.com/CVEnew/status/2016128325505478771 · Twitter Post
• https://t.me/cveNotify/149976 · Telegram Post
• https://pix-link.com/lv-wr21q · Note
• https://t.me/cveNotify/149975 · Telegram Post