Lb-link vulnerabilities
We track 20 vulnerabilities in Lb-link products across 19 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on August 15, 2026.
Latest Lb-link vulnerabilities
- 8.1 High severity
X-PRO: Use of Hard-coded Password
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature ar
- 8.1 High severity
X-PRO: Use of Hard-coded Password
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity
- 9.8 Critical severity
BL-WR9000: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
- 7.5 High severity
BL-WR9000: Out-of-bounds Read
A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit
- 9.8 Critical severity
BL-WR9000: Out-of-bounds Write
A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The explo
- 8.8 High severity
BL-AC2100: Out-of-bounds Write
A security flaw has been discovered in B-Link BL-AC2100 up to 1.0.3. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg of the component Web Management Interface. The manipulation of the argument Type results in stack-base
- 8.8 High severity
Bl-cpe300m Firmware: Improper Authentication
The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same I
- 8.8 High severity
BL-X26: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launche
- 8.8 High severity
BL-X26: Improper Neutralization of Special Elements used in an OS Command
A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP Handler. This manipulation of the argument enable causes os command injection. The attack can be init
- 9.8 Critical severity
BL-AC1900: Improper Authentication
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Inte
- 7.5 High severity
BL-AC3600: Insufficiently Protected Credentials
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to
- 7.8 High severity
BL-AC3600: Use of Hard-coded Credentials
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local
- 9.8 Critical severity
Bl-ac2100 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.
- 9.8 Critical severity
Bl-ac2100 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice.
- 9.8 Critical severity
AC1900 Router: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may
- 9.8 Critical severity
AC1900 Router: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can
- 9.8 Critical severity
AC1900 Router: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd leads to os command injection. It is possible to launch t
- 8.1 High severity
bl-w1210m: Improper Restriction of Rendered UI Layers or Frames
LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.
- 9.8 Critical severity
bl_w1210m: Improper Privilege Management
Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication.
- 9.8 Critical severity
Bl-lte300 Firmware: Improper Neutralization of Special Elements used in a Command
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.