CVE-2025-12386mediumCWE-306

CVE-2025-12386: falha de média gravidade em Pix-Link LV-WR21Q

Missing Authentication for Critical Endpoint in Pix-Link LV-WR21Q

Publicada em

Seguir esta CVE+ Monitorar LV-WR21Q+ Monitorar WR21Q

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.8%
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Pix-Link · LV-WR21QPix-Link · WR21Q
CVEs relacionadas — Pix-Link LV-WR21Q

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12387MEDIUMDenial of Service in Pix-Link LV-WR21QEPSS 0.7%