CVE-2025-1609

CRITICAL

A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of ...

Affects 2 products across 1 vendor.

BCS7.37
CVSS 3.19.8
CVSS v45.3
EPSS10.0%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-77: Command Injection

Attacker injects operating system commands through application inputs passed to a shell or system call.

CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-77 CWE-78
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-77
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-77 CWE-78
Show all 11
via CWE-77
via CWE-77
via CWE-78
via CWE-77
via CWE-77
via CWE-77

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability (CVE-2025-1609) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_cmd file, enabling remote attackers to execute arbitrary commands.

BSID: BS-2025-GLOBAL-235487-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-1609?
A critical vulnerability (CVE-2025-1609) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_cmd file, enabling remote attackers to execute arbitrary commands.
What is the CVSS score for CVE-2025-1609?
CVE-2025-1609 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 10.0%.
Is CVE-2025-1609 actively exploited?
No confirmed active exploitation of CVE-2025-1609 as of 2026-05-30.
How do I remediate CVE-2025-1609?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-1609?
CVE-2025-1609 affects: Lb-Link, Lb-Link.
Vulnerability Details
CVE IDCVE-2025-1609
BSIDBS-2025-GLOBAL-235487-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-02-24
Last Modified2025-11-04
ICS Relevance25%
Weakness (CWE)
Command InjectionOS Command Injection
SourceNVD
Official Description

A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by manipulating the 'cmd' argument in the websGetVar function within the /goform/set_cmd file, leading to OS command injection. This can be triggered remotely, and the exploit has been publicly disclosed.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Lb-Link Ac1900 Firmware —
Lb-Link Ac1900 —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 551 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd7e73b518d15f0064bdf6c698ea38985273d51d53d1e0d4bd94912fad10e768ab00f1fc8fa0d5d6ced4378a5ff5a99a04cbb2413af6a31501ee7e0657fbbac1a
Related CVEs affecting Lb-Link
CVE-2025-1608 9.8 A vulnerability, which was classified as critical, was found in LB-LINK AC190... CVE-2023-26801 9.8 LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5... CVE-2024-33375 9.8 LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext ... CVE-2024-51431 9.8 LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/sha... CVE-2025-1610 9.8 A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as cr...
View all Lb-Link CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →