CVE-2025-12386 Missing Authentication for Critical Endpoint in Pix-Link LV-WR21Q
Unauthenticated attackers can access a critical endpoint on Pix-Link routers to retrieve cleartext passwords, leading to potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12386?
CVE-2025-12386 is a medium-severity missing authorization vulnerability in Pix-Link LV-WR21Q, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Weakness: CWE-306
Which versions are affected by CVE-2025-12386?
How do I fix CVE-2025-12386?
No fix has been published for CVE-2025-12386 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12386 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12386 exists.
Sources
Also known as GHSA-4hm5-jmp9-7g72.