CVE-2025-1609
Published: 24 February 2025
Summary
CVE-2025-1609 is a medium-severity Command Injection (CWE-77) vulnerability in Lb-Link Ac1900 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1609 is an OS command injection vulnerability (CWE-77, CWE-78) in the LB-LINK AC1900 Router version 1.0.2. The issue resides in the websGetVar function within the /goform/set_cmd file, where manipulation of the "cmd" argument enables arbitrary command execution. Published on 2025-02-24, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is classified as critical.
The vulnerability is exploitable remotely by low-privileged users (PR:L) with no need for user interaction. Attackers can inject and execute operating system commands, potentially achieving low impacts on confidentiality, integrity, and availability, such as limited data access, modification, or service disruption on the affected router.
Advisories from sources like VulDB indicate the exploit has been publicly disclosed and is available for use, with details shared via a Notion page and submission entries. The vendor was notified early but provided no response, leaving no official patches or mitigations documented at this time.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4389
Vulnerability details
A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection via remote web interface (/goform/set_cmd) enables exploitation of public-facing applications (T1190), network device CLI command execution (T1059.008), and indirect command execution (T1202).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of inputs like the 'cmd' argument in websGetVar to directly prevent OS command injection.
Mandates timely identification, reporting, and remediation of known flaws such as this command injection vulnerability through patching or workarounds.
Enforces least privilege on the router's web service process to limit the scope and impact of arbitrary OS commands executed via injection.