CVE-2025-57685

HighCVSS 8.8/10Last modified Jul 5, 2026

Description

The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set_serial_cfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2025
Last modified: Jul 5, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-576926.8PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of CVE-2025-576976.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defin CVE-2025-576987.5AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/i CVE-2025-576998.4Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user w CVE-2025-57706.1A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of outpu CVE-2025-577006.1DIAEnergie - Stored Cross-site Scripting CVE-2025-577016.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577026.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577036.1DIAEnergie - Reflected Cross-site Scripting CVE-2025-577045.5Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerabili CVE-2025-577054.9An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If CVE-2025-577065.4A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can t