CVE-2025-1608

CRITICAL

A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument rou...

Affects 2 products across 1 vendor.

BCS7.37
CVSS 3.19.8
CVSS v45.3
EPSS10.0%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-77: Command Injection

Attacker injects operating system commands through application inputs passed to a shell or system call.

CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-77 CWE-78
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-77
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-77 CWE-78
Show all 11
via CWE-77
via CWE-77
via CWE-78
via CWE-77
via CWE-77
via CWE-77

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability (CVE-2025-1608) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_manpwd file, enabling remote attackers to execute arbitrary commands.

BSID: BS-2025-GLOBAL-042437-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-1608?
A critical vulnerability (CVE-2025-1608) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_manpwd file, enabling remote attackers to execute arbitrary commands.
What is the CVSS score for CVE-2025-1608?
CVE-2025-1608 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 10.0%.
Is CVE-2025-1608 actively exploited?
No confirmed active exploitation of CVE-2025-1608 as of 2026-05-30.
How do I remediate CVE-2025-1608?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-1608?
CVE-2025-1608 affects: Lb-Link, Lb-Link.
Vulnerability Details
CVE IDCVE-2025-1608
BSIDBS-2025-GLOBAL-042437-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-02-24
Last Modified2025-11-04
ICS Relevance25%
Weakness (CWE)
Command InjectionOS Command Injection
SourceNVD
Official Description

A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd  leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by manipulating the 'routepwd' argument in the /goform/set_manpwd file, leading to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Lb-Link Ac1900 Firmware —
Lb-Link Ac1900 —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 559 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashb50281dc77e6d1bfbba780cc52e677d114e2917b78b6ee24341396365d7c7040e938d19543a93ac7e9ed2e31c78cfbc730f23b9a6d43871c5521f09f6ec75c65
Related CVEs affecting Lb-Link
CVE-2025-1609 9.8 A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified ... CVE-2023-26801 9.8 LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5... CVE-2024-33375 9.8 LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext ... CVE-2024-51431 9.8 LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/sha... CVE-2025-1610 9.8 A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as cr...
View all Lb-Link CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →