CVE-2025-45986
📋 TL;DR
This CVE describes a command injection vulnerability in multiple Blink router models that allows attackers to execute arbitrary commands on affected devices. Attackers can exploit this by injecting malicious commands through the mac parameter in the bs_SetMacBlack function. Users of the listed Blink router models with vulnerable firmware versions are affected.
💻 Affected Systems
- Blink BL-WR9000
- Blink BL-AC2100_AZ3
- Blink BL-X10_AC8
- Blink BL-LTE300
- Blink BL-F1200_AT1
- Blink BL-X26_AC8
- Blink BLAC450M_AE4
- Blink BL-X26_DA3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept all network traffic, pivot to internal networks, and use the router as part of a botnet.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation prevents lateral movement.
🎯 Exploit Status
The GitHub reference contains technical details and proof-of-concept. The high CVSS score and public disclosure make weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download appropriate firmware for your model. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allDisable WAN-side access to router management interface
Network segmentation
allPlace routers in isolated network segments with strict firewall rules
🧯 If You Can't Patch
- Replace vulnerable routers with supported models from different vendors
- Implement strict network monitoring and intrusion detection for router traffic
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface against affected versions list. If version matches, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Information pageVerify Fix Applied:
Verify firmware version has been updated to a version not listed in affected versions. Test MAC blacklist functionality with safe input.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in router logs
- Multiple failed MAC blacklist attempts
- Unexpected system command execution
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains from router
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")