CVE-2025-45988
Published: 13 June 2025
Summary
CVE-2025-45988 is a critical-severity Command Injection (CWE-77) vulnerability in B-Link Bl-Wr9000 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-45988 affects multiple LB-LINK router models including BL-WR9000 V2.4.9, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5, BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7. The devices contain several instances of command injection in the bs_SetCmd function that accept unsanitized input through the cmd parameter, corresponding to CWE-77.
An unauthenticated attacker with network access can supply crafted values to the cmd parameter and execute arbitrary operating-system commands on the router. Successful exploitation yields full control over the device, enabling actions consistent with the CVSS 9.8 rating of complete confidentiality, integrity and availability impact.
Public disclosure of the issues appears in a technical write-up hosted on GitHub that demonstrates the injection vectors; no vendor advisory or firmware patch information is referenced in the available sources. The associated EPSS score has remained at 0.1330 without a documented rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18261
Vulnerability details
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.