CVE-2025-45984 Command injection in n/a

Critical 9.8 Published 13 Jun 2025 Updated 13 Jun 2025

Attackers can execute arbitrary commands on Blink routers via the routepwd parameter, potentially compromising the device.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-45984?

CVE-2025-45984 is a critical command injection vulnerability in n/a, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function.

Weakness: CWE-77

Which versions are affected by CVE-2025-45984?

It affects 9 products.

Products include B-Link Bl-Ac1900 Firmware, B-Link Bl-Ac2100 Az3 Firmware, B-Link Bl-F1200 At1 Firmware, B-Link Bl-Lte300 Firmware, B-Link Bl-Wr9000 Firmware, B-Link Bl-X10 Ac8 Firmware and 3 more.

How do I fix CVE-2025-45984?

No fix has been published for CVE-2025-45984 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-45984 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-45984 exists.

CVE-2025-45988 Command injection in n/a Critical 9.8

Sources

Also known as GHSA-pmpg-h38x-qjm9.