CVE-2025-57685
Sept. 22, 2025, 9:22 p.m.
None
No Score
Description
The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set_serial_cfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Lb-link |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| h | lb-link | bl-ac2100_az3 | v1.0.4 | / | / | / | / | / | / | / |
| h | lb-link | bl-wr4000 | v2.5.0 | / | / | / | / | / | / | / |
| h | lb-link | bl-wr9000_ae4 | v2.4.9 | / | / | / | / | / | / | / |
| h | lb-link | bl-ac1900_az2 | v1.0.2 | / | / | / | / | / | / | / |
| h | lb-link | bl-x26_ac8 | v1.2.8 | / | / | / | / | / | / | / |
| h | lb-link | bl-lte300_da4 | v1.2.3 | / | / | / | / | / | / | / |
Tags
Timeline
Published: Sept. 22, 2025, 7:15 p.m.
Last Modified: Sept. 22, 2025, 9:22 p.m.
Last Modified: Sept. 22, 2025, 9:22 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cve@mitre.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.