CVE-2025-57685: Command Injection
The LB-Link routers, including the BL-AC2100AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000AE4 v2.4.9, BL-AC1900AZ2 v1.0.2, BL-X26AC8 v1.2.8, and BL-LTE300DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/setserialcfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57685?
CVE-2025-57685 is classified as a high severity vulnerability due to the potential for unauthorized command injection.
How do I fix CVE-2025-57685?
To remediate CVE-2025-57685, users should update their LB-Link router to the latest firmware version provided by the manufacturer.
Which models are affected by CVE-2025-57685?
CVE-2025-57685 affects multiple LB-Link router models including BL-AC2100_AZ3, BL-WR4000, BL-WR9000_AE4, BL-AC1900_AZ2, BL-X26_AC8, and BL-LTE300_DA4.
What kind of attack can exploit CVE-2025-57685?
The vulnerability in CVE-2025-57685 can be exploited through unauthorized command injection attacks.
Is there a workaround for CVE-2025-57685?
Currently, the most effective workaround for CVE-2025-57685 is to disconnect the affected devices from the network until a firmware update is applied.