MidnightBSD

Advisories for b-link

CVE-2025-45984

Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3.9 5.9

Products Affected

Vendor Product Version
b-link bl-f1200_at1_firmware 1.0.0
b-link bl-x26_da3_firmware 1.2.7
b-link bl-ac2100_az3_firmware 1.0.4
b-link bl-ac1900_firmware 1.0.2
b-link bl-x10_ac8_firmware 1.0.5
b-link bl-x26_ac8_firmware 1.2.8
b-link bl-wr9000_firmware 2.4.9
b-link bl-lte300_firmware 1.2.3
b-link blac450m_ae4_firmware 4.0.0
CVE-2025-45985

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3.9 5.9

Products Affected

Vendor Product Version
b-link bl-f1200_at1_firmware 1.0.0
b-link bl-x26_da3_firmware 1.2.7
b-link bl-ac2100_az3_firmware 1.0.4
b-link bl-x10_ac8_firmware 1.0.5
b-link bl-x26_ac8_firmware 1.2.8
b-link bl-wr9000_firmware 2.4.9
b-link bl-lte300_firmware 1.2.3
b-link blac450m_ae4_firmware 4.0.0
CVE-2025-45986

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3.9 5.9

Products Affected

Vendor Product Version
b-link bl-f1200_at1_firmware 1.0.0
b-link bl-x26_da3_firmware 1.2.7
b-link bl-ac2100_az3_firmware 1.0.4
b-link bl-x10_ac8_firmware 1.0.5
b-link bl-x26_ac8_firmware 1.2.8
b-link bl-wr9000_firmware 2.4.9
b-link bl-lte300_firmware 1.2.3
b-link blac450m_ae4_firmware 4.0.0
CVE-2025-45987

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3.9 5.9

Products Affected

Vendor Product Version
b-link bl-f1200_at1_firmware 1.0.0
b-link bl-x26_da3_firmware 1.2.7
b-link bl-ac2100_az3_firmware 1.0.4
b-link bl-x26_ac8_firmware 1.2.8
b-link bl-wr9000_firmware 2.4.9
b-link bl-lte300_firmware 1.2.3
b-link blac450m_ae4_firmware 4.0.0
CVE-2025-45988

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3.9 5.9

Products Affected

Vendor Product Version
b-link bl-f1200_at1_firmware 1.0.0
b-link bl-x26_da3_firmware 1.2.7
b-link bl-ac2100_az3_firmware 1.0.4
b-link bl-ac1900_firmware 1.0.2
b-link bl-x10_ac8_firmware 1.0.5
b-link bl-x26_ac8_firmware 1.2.8
b-link bl-wr9000_firmware 2.4.9
b-link bl-lte300_firmware 1.2.3
b-link blac450m_ae4_firmware 4.0.0
CVE-2025-9579 MEDIUM

A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP Handler. This manipulation of the argument enable causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
nvd@nist.gov 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2.8 5.9
cna@vuldb.com 6.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L 2.8 3.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-77,CWE-78,CWE-78,

Products Affected

Vendor Product Version
b-link bl-x26_firmware 1.2.8