Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2983▼ 79 respecto a la semana anterior
Críticas / altas1412▲ 62 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior
9 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (8.8) | 1.2% | — | Lb-link Bl-ac2100 AZ3AILb-link Bl-wr4000AILb-link Bl-wr9000 AE4AILb-link Bl-ac1900 AZ2AI+2 | 22/9/2025 | 5/7/2026 | The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set_serial_cfg interface to gain… | |
| Aplazada | Alta (8.9) | 0.83% | — | Lb-link Bl-ac1900AILb-link Bl-ac2100 AZ3AILb-link Bl-ac3600AILb-link Bl-ax1800AI+2 | 14/7/2025 | 17/6/2026 | A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Interface. The manipulation leads to improper authentication.… | |
| Aplazada | Media (5.5) | 0.38% | — | Lb-link Bl-ac1900AILb-link Bl-ac2100 AZ3AILb-link Bl-ac3600AILb-link Bl-ax1800AI+2 | 14/7/2025 | 17/6/2026 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This issue affects the function bs_GetManPwd in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information… | |
| Aplazada | Media (5.5) | 0.38% | — | Lb-link Bl-ac1900AILb-link Bl-ac2100 AZ3AILb-link Bl-ac3600AILb-link Bl-ax1800AI+2 | 14/7/2025 | 17/6/2026 | A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure.… | |
| Analizada | Crítica (9.8) | 11% | — | B-link Bl-wr9000 FirmwareB-link Bl-ac1900 FirmwareB-link Bl-ac2100 AZ3 FirmwareB-link Bl-x10 AC8 Firmware+5 | 13/6/2025 | 17/6/2026 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function. | |
| Analizada | Crítica (9.8) | 1.9% | — | B-link Bl-wr9000 FirmwareB-link Bl-ac2100 AZ3 FirmwareB-link Bl-lte300 FirmwareB-link Bl-f1200 AT1 Firmware+3 | 13/6/2025 | 17/6/2026 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function. | |
| Analizada | Crítica (9.8) | 1.6% | — | B-link Bl-x10 AC8 FirmwareB-link Bl-lte300 FirmwareB-link Bl-wr9000 FirmwareB-link Bl-ac2100 AZ3 Firmware+4 | 13/6/2025 | 17/6/2026 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function. | |
| Analizada | Crítica (9.8) | 6.9% | 💥 Exploit | B-link Bl-wr9000 FirmwareB-link Bl-ac2100 AZ3 FirmwareB-link Bl-x10 AC8 FirmwareB-link Bl-lte300 Firmware+4 | 13/6/2025 | 17/6/2026 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function. | |
| Analizada | Crítica (9.8) | 1.6% | — | B-link Bl-wr9000 FirmwareB-link Bl-ac1900 FirmwareB-link Bl-ac2100 AZ3 FirmwareB-link Bl-x10 AC8 Firmware+5 | 13/6/2025 | 17/6/2026 | Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function. |