CVE-2025-29063

A command injection class vulnerability (CWE-77) exists in the handling of the 'enable' parameter passed to the /goform/set_hidessid_cfg endpoint in the device's web interface. This parameter is not properly validated or sanitized before use, allowing an attacker to inject and execute arbitrary system commands. The attack does not require authentication or user interaction, and can be carried out remotely over the network.

An attacker can gain full control of the device, including the ability to read and modify configuration, eavesdrop on network traffic, and use the router as an entry point for further actions on the local network.

Patches available from the manufacturer should be applied according to the references. Until an update is applied, it is recommended to restrict access to the device's administrative panel exclusively to trusted hosts and isolate the device from public network access using a firewall.

LB-Link BL-AC2100 with firmware version V1.0.4 and earlier versions