Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Blink Routers: Unsecured Command Input Can Lead to Remote Access

CVE-2025-45988 · published 1 year ago
Summary

Certain Blink routers have a security flaw that could allow hackers to execute unauthorized commands on the device. This could potentially give them access to the device's settings and data. Blink recommends updating the router's firmware to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
b-link bl-wr9000_firmware 2.4.9
cpe:2.3:o:b-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*
b-link bl-ac1900_firmware 1.0.2
cpe:2.3:o:b-link:bl-ac1900_firmware:1.0.2:*:*:*:*:*:*:*
b-link bl-ac2100_az3_firmware 1.0.4
cpe:2.3:o:b-link:bl-ac2100_az3_firmware:1.0.4:*:*:*:*:*:*:*
b-link bl-x10_ac8_firmware 1.0.5
cpe:2.3:o:b-link:bl-x10_ac8_firmware:1.0.5:*:*:*:*:*:*:*
b-link bl-lte300_firmware 1.2.3
cpe:2.3:o:b-link:bl-lte300_firmware:1.2.3:*:*:*:*:*:*:*
b-link bl-f1200_at1_firmware 1.0.0
cpe:2.3:o:b-link:bl-f1200_at1_firmware:1.0.0:*:*:*:*:*:*:*
b-link bl-x26_ac8_firmware 1.2.8
cpe:2.3:o:b-link:bl-x26_ac8_firmware:1.2.8:*:*:*:*:*:*:*
b-link blac450m_ae4_firmware 4.0.0
cpe:2.3:o:b-link:blac450m_ae4_firmware:4.0.0:*:*:*:*:*:*:*
b-link bl-x26_da3_firmware 1.2.7
cpe:2.3:o:b-link:bl-x26_da3_firmware:1.2.7:*:*:*:*:*:*:*
Original advisory text
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to con...
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
11% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published13 Jun 2025
Updated19 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-45988 · NVD
Track software like this
Free during beta