CVE-2025-1608
Published: 24 February 2025
Summary
CVE-2025-1608 is a medium-severity Command Injection (CWE-77) vulnerability in Lb-Link Ac1900 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1608 is an OS command injection vulnerability classified as critical in the LB-LINK AC1900 Router version 1.0.2. The flaw affects the websGetVar function in the /goform/set_manpwd file, where manipulation of the routepwd argument enables command injection. It was published on 2025-02-24 and is associated with CWE-77 and CWE-78, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows injection and execution of arbitrary operating system commands, resulting in low impacts to confidentiality, integrity, and availability.
Advisories from VulDB and a public disclosure on a Notion site detail the vulnerability and provide exploit information. The vendor was contacted early regarding the issue but has not responded, and no patches or mitigations are mentioned in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4391
Vulnerability details
A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd leads to os command injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection in public-facing router web interface (/goform/set_manpwd) enables remote exploitation of the device (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by requiring validation of untrusted inputs like the routepwd argument in the websGetVar function.
Ensures timely identification, reporting, and correction of the specific command injection flaw in the router's /goform/set_manpwd endpoint.
Restricts the type, amount, and format of inputs to the vulnerable function, reducing opportunities for successful command injection payloads.