Cyber Posture

CVE-2025-1609

MediumPublic PoC

Published: 24 February 2025

Published
24 February 2025
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0081 74.2th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Security Summary

CVE-2025-1609 is an OS command injection vulnerability (CWE-77, CWE-78) in the LB-LINK AC1900 Router version 1.0.2. The issue resides in the websGetVar function within the /goform/set_cmd file, where manipulation of the "cmd" argument enables arbitrary command execution. Published on 2025-02-24, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is classified as critical.

The vulnerability is exploitable remotely by low-privileged users (PR:L) with no need for user interaction. Attackers can inject and execute operating system commands, potentially achieving low impacts on confidentiality, integrity, and availability, such as limited data access, modification, or service disruption on the affected router.

Advisories from sources like VulDB indicate the exploit has been publicly disclosed and is available for use, with details shared via a Notion page and submission entries. The vendor was notified early but provided no response, leaving no official patches or mitigations documented at this time.

Details

CWE(s)
CWE-77CWE-78

Affected Products

lb-link
ac1900 firmware
1.0.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

OS command injection via remote web interface (/goform/set_cmd) enables exploitation of public-facing applications (T1190), network device CLI command execution (T1059.008), and indirect command execution (T1202).

References