CVE-2025-29062
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on BL-AC2100 routers by exploiting improper input validation in the goahead webservice's set_LimitClient_cfg function. Attackers can send malicious time1 and time2 parameters to achieve remote code execution. All users with BL-AC2100 routers running firmware version V1.0.4 or earlier are affected.
💻 Affected Systems
- BL-AC2100 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install persistent backdoors, pivot to internal networks, steal credentials, and use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, network traffic interception, and potential lateral movement to other devices on the network.
If Mitigated
Limited impact if device is behind firewall with restricted inbound access and proper network segmentation.
🎯 Exploit Status
The vulnerability is in a web service endpoint that doesn't require authentication. Exploitation involves sending crafted HTTP requests with malicious parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates
2. If update available, download and install via web interface
3. Reboot router after installation
4. Verify version is newer than V1.0.4
🔧 Temporary Workarounds
Disable Remote Management
allDisable web management interface from WAN/external networks
Access router admin interface -> Advanced -> System -> Remote Management -> Disable
Restrict Access with Firewall
linuxBlock external access to router management ports (typically 80/443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict access controls
- Implement network monitoring for suspicious HTTP requests to /goform/set_LimitClient_cfg endpoint
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or via SSH: cat /etc/versionCheck Version:
curl -s http://router-ip/goform/getSysStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than V1.0.4 and test if set_LimitClient_cfg endpoint still accepts malicious time parameters📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/set_LimitClient_cfg with unusual time parameters
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 containing time1/time2 parameters with shell metacharacters
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND (uri="/goform/set_LimitClient_cfg" AND (time1="*;*" OR time2="*;*" OR time1="*|*" OR time2="*|*"))