LOW🇵🇱 Wersja polska

CVE-2025-9580

CVSS 2.1v4.0pub. 2025-08-28upd. 2026-04-29

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Lb Link Bl X26

    HW
    Lb-Link
    wszystkie wersje

  • Lb Link Bl X26 Firmware

    OS
    Lb-Link
    1.2.8
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2023-26801CRITICAL9.8ten sam produkt

LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 we...

CVE-2025-29063CRITICAL9.8PL ✓ten sam vendor

RCE w LB-Link BL-AC2100 — nieprawidłowa obsługa parametru enable

CVE-2025-29062CRITICAL9.8PL ✓ten sam vendor

RCE w LB-Link BL-AC2100 przez parametry set_LimitClient_cfg

CVE-2024-51431CRITICAL9.8PL ✓ten sam vendor

Zakodowane na stałe dane uwierzytelniające w routerze LB-LINK BL-WR1300H

CVE-2024-33375CRITICAL9.8PL ✓ten sam vendor

LB-LINK BL-W1210M — przechowywanie danych uwierzytelniających w postaci jawnej