CVE-2025-45984: b-link bl-wr9000 firmware +8 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-45984

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada b-link bl-wr9000 firmware, b-link bl-ac1900 firmware +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function.

Rincian

Terbit di NVD: 13 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari): 1,6% peluang dieksploitasi; lebih tinggi dari 75,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
b-link	bl-wr9000 firmware	Versi 2.4.9
b-link	bl-ac1900 firmware	Versi 1.0.2
b-link	bl-ac2100 az3 firmware	Versi 1.0.4
b-link	bl-x10 ac8 firmware	Versi 1.0.5
b-link	bl-lte300 firmware	Versi 1.2.3
b-link	bl-f1200 at1 firmware	Versi 1.0.0
b-link	bl-x26 ac8 firmware	Versi 1.2.8
b-link	blac450m ae4 firmware	Versi 4.0.0
b-link	bl-x26 da3 firmware	Versi 1.2.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_routepwd%20Indicates%20the%20unauthorized... exploit

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.