CVE-2025-45987

Published: Jun 13, 2025Modified: Jul 10, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.

Affected (7)

Products: B Link: Bl Wr9000 Firmware, Bl Ac2100 Az3 Firmware, Bl Lte300 Firmware, Bl F1200 At1 Firmware, Bl X26 Ac8 Firmware, Blac450m Ae4 Firmware, Bl X26 Da3 Firmware

B Link

7 products

Bl Wr9000 Firmware

Bl Ac2100 Az3 Firmware

Bl Lte300 Firmware

Bl F1200 At1 Firmware

Bl X26 Ac8 Firmware

Blac450m Ae4 Firmware

Bl X26 Da3 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl Wr9000 Firmware	Version 2.4.9

Running on/with	Platform Versions
B Link Bl Wr9000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl Ac2100 Az3 Firmware	Version 1.0.4

Running on/with	Platform Versions
B Link Bl Ac2100 Az3	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl Lte300 Firmware	Version 1.2.3

Running on/with	Platform Versions
B Link Bl Lte300	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl F1200 At1 Firmware	Version 1.0.0

Running on/with	Platform Versions
B Link Bl F1200 At1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl X26 Ac8 Firmware	Version 1.2.8

Running on/with	Platform Versions
B Link Bl X26 Ac8	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Blac450m Ae4 Firmware	Version 4.0.0

Running on/with	Platform Versions
B Link Blac450m Ae4	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
B Link Bl X26 Da3 Firmware	Version 1.2.7

Running on/with	Platform Versions
B Link Bl X26 Da3	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (1)

https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_dns1%20Unauthorized%20command%20injection/The%20LB-LINK_dns1%20command%20is%20used%20to%20inject%20the%20information.md

Source: cve@mitre.org

Exploit

Timeline

No history available yet.