CVE-2025-9580

MediumCVSS 6.3

Published: 28/08/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.73%

94th percentile - higher than 94% of all known CVEs

Summary

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8 affecting an unknown function of the file /goform/set_blacklist (HTTP Handler component). Manipulation of the mac argument leads to OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.

Risk Assessment

A remote attacker can execute arbitrary OS commands on the device, taking full control. Since the exploit is public, the risk of exploitation is high.

Recommendation

Apply available firmware updates from the vendor or, if none exist, restrict access to the management interface and consider retiring the device.

Other vulnerabilities in LB-LINK BL-X26

CVE-2025-9579Medium
A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP Handler. This manipulation of the argument enable causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Original NVD description (English source)

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS