{"advisories":[{"id":"EUVD-2025-18261","source":"euvd","title":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18261"}],"cve":"CVE-2025-45988","epss":{"score":0.10883},"mitre":{"cpes":[],"created":"2025-06-13T00:00:00+00:00","description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/45xxx/CVE-2025-45988.json","references":["https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md"],"title":null,"updated":"2025-06-13T15:06:37.196000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:h:b-link:bl-ac1900:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-ac2100_az3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-f1200_at1:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-lte300:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-wr9000:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x10_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_da3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:blac450m_ae4:-:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac1900_firmware:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac2100_az3_firmware:1.0.4:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-f1200_at1_firmware:1.0.0:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-lte300_firmware:1.2.3:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x10_ac8_firmware:1.0.5:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_ac8_firmware:1.2.8:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_da3_firmware:1.2.7:*:*:*:*:*:*:*","cpe:2.3:o:b-link:blac450m_ae4_firmware:4.0.0:*:*:*:*:*:*:*"],"created":"2025-06-13T12:15:34.403000+00:00","description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-45988.json","references":["https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md"],"title":null,"updated":"2026-06-17T09:25:51.847000+00:00","vendors":["b-link","b-link$PRODUCT$bl-ac1900","b-link$PRODUCT$bl-ac1900_firmware","b-link$PRODUCT$bl-ac2100_az3","b-link$PRODUCT$bl-ac2100_az3_firmware","b-link$PRODUCT$bl-f1200_at1","b-link$PRODUCT$bl-f1200_at1_firmware","b-link$PRODUCT$bl-lte300","b-link$PRODUCT$bl-lte300_firmware","b-link$PRODUCT$bl-wr9000","b-link$PRODUCT$bl-wr9000_firmware","b-link$PRODUCT$bl-x10_ac8","b-link$PRODUCT$bl-x10_ac8_firmware","b-link$PRODUCT$bl-x26_ac8","b-link$PRODUCT$bl-x26_ac8_firmware","b-link$PRODUCT$bl-x26_da3","b-link$PRODUCT$bl-x26_da3_firmware","b-link$PRODUCT$blac450m_ae4","b-link$PRODUCT$blac450m_ae4_firmware"],"weaknesses":["CWE-77"]},"opencve":{"changes":[{"created":"2025-06-13T11:45:00+00:00","data":[{"details":{"new":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","old":null},"type":"description"},{"details":{"added":["https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md"],"removed":[]},"type":"references"}],"id":"ab817cb3-3253-4b62-9133-02e31fff2ecc"},{"created":"2025-06-13T15:15:00+00:00","data":[{"details":{"added":["CWE-77"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"56e9d824-5b58-4f4f-906d-2f6583e3ffbf"},{"created":"2025-07-10T12:45:00+00:00","data":[{"details":["b-link","b-link$PRODUCT$bl-ac1900","b-link$PRODUCT$bl-ac1900_firmware","b-link$PRODUCT$bl-ac2100_az3","b-link$PRODUCT$bl-ac2100_az3_firmware","b-link$PRODUCT$bl-f1200_at1","b-link$PRODUCT$bl-f1200_at1_firmware","b-link$PRODUCT$bl-lte300","b-link$PRODUCT$bl-lte300_firmware","b-link$PRODUCT$bl-wr9000","b-link$PRODUCT$bl-wr9000_firmware","b-link$PRODUCT$bl-x10_ac8","b-link$PRODUCT$bl-x10_ac8_firmware","b-link$PRODUCT$bl-x26_ac8","b-link$PRODUCT$bl-x26_ac8_firmware","b-link$PRODUCT$bl-x26_da3","b-link$PRODUCT$bl-x26_da3_firmware","b-link$PRODUCT$blac450m_ae4","b-link$PRODUCT$blac450m_ae4_firmware"],"type":"first_time"},{"details":{"added":["cpe:2.3:h:b-link:bl-ac1900:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-ac2100_az3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-f1200_at1:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-lte300:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-wr9000:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x10_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_da3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:blac450m_ae4:-:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac1900_firmware:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac2100_az3_firmware:1.0.4:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-f1200_at1_firmware:1.0.0:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-lte300_firmware:1.2.3:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x10_ac8_firmware:1.0.5:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_ac8_firmware:1.2.8:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_da3_firmware:1.2.7:*:*:*:*:*:*:*","cpe:2.3:o:b-link:blac450m_ae4_firmware:4.0.0:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["b-link","b-link$PRODUCT$bl-ac1900","b-link$PRODUCT$bl-ac1900_firmware","b-link$PRODUCT$bl-ac2100_az3","b-link$PRODUCT$bl-ac2100_az3_firmware","b-link$PRODUCT$bl-f1200_at1","b-link$PRODUCT$bl-f1200_at1_firmware","b-link$PRODUCT$bl-lte300","b-link$PRODUCT$bl-lte300_firmware","b-link$PRODUCT$bl-wr9000","b-link$PRODUCT$bl-wr9000_firmware","b-link$PRODUCT$bl-x10_ac8","b-link$PRODUCT$bl-x10_ac8_firmware","b-link$PRODUCT$bl-x26_ac8","b-link$PRODUCT$bl-x26_ac8_firmware","b-link$PRODUCT$bl-x26_da3","b-link$PRODUCT$bl-x26_da3_firmware","b-link$PRODUCT$blac450m_ae4","b-link$PRODUCT$blac450m_ae4_firmware"],"removed":[]},"type":"vendors"}],"id":"92f57e06-2a4e-428a-8319-0458fca5e595"},{"created":"2025-07-11T13:45:00+00:00","data":[{"details":{"added":{},"removed":{},"updated":{"epss":{"new":{"score":0.0087},"old":{"score":0.00386}}}},"type":"metrics"}],"id":"3fe4a0da-9d2b-4706-9f4f-17e15313fc45"},{"created":"2025-07-15T13:45:00+00:00","data":[{"details":{"added":{},"removed":{},"updated":{"epss":{"new":{"score":0.00847},"old":{"score":0.0087}}}},"type":"metrics"}],"id":"1f96d47c-8c00-4d0f-bd3b-55443c53bef4"}],"cpes":{"data":["cpe:2.3:h:b-link:bl-ac1900:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-ac2100_az3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-f1200_at1:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-lte300:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-wr9000:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x10_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_ac8:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:bl-x26_da3:-:*:*:*:*:*:*:*","cpe:2.3:h:b-link:blac450m_ae4:-:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac1900_firmware:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-ac2100_az3_firmware:1.0.4:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-f1200_at1_firmware:1.0.0:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-lte300_firmware:1.2.3:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x10_ac8_firmware:1.0.5:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_ac8_firmware:1.2.8:*:*:*:*:*:*:*","cpe:2.3:o:b-link:bl-x26_da3_firmware:1.2.7:*:*:*:*:*:*:*","cpe:2.3:o:b-link:blac450m_ae4_firmware:4.0.0:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2025-06-13T00:00:00+00:00","provider":"mitre"},"description":{"data":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.10883},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2025-07-10T12:16:15.107000+00:00","provider":"nvd"},"vendors":{"data":["b-link","b-link$PRODUCT$bl-ac1900","b-link$PRODUCT$bl-ac1900_firmware","b-link$PRODUCT$bl-ac2100_az3","b-link$PRODUCT$bl-ac2100_az3_firmware","b-link$PRODUCT$bl-f1200_at1","b-link$PRODUCT$bl-f1200_at1_firmware","b-link$PRODUCT$bl-lte300","b-link$PRODUCT$bl-lte300_firmware","b-link$PRODUCT$bl-wr9000","b-link$PRODUCT$bl-wr9000_firmware","b-link$PRODUCT$bl-x10_ac8","b-link$PRODUCT$bl-x10_ac8_firmware","b-link$PRODUCT$bl-x26_ac8","b-link$PRODUCT$bl-x26_ac8_firmware","b-link$PRODUCT$bl-x26_da3","b-link$PRODUCT$bl-x26_da3_firmware","b-link$PRODUCT$blac450m_ae4","b-link$PRODUCT$blac450m_ae4_firmware"],"providers":["nvd"]},"weaknesses":{"data":["CWE-77"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2025-06-13T00:00:00+00:00","description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2025-06-13T15:05:28.145000+00:00","vendors":[],"vulnrichment_repo_path":"2025/45xxx/CVE-2025-45988.json","weaknesses":["CWE-77"]}}