CVE-2025-1610

CRITICAL

A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the arg...

Affects 2 products across 1 vendor.

BCS6.97
CVSS 3.19.8
CVSS v45.3
EPSS12.9%
Percentile96th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-77: Command Injection

Attacker injects operating system commands through application inputs passed to a shell or system call.

CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-77 CWE-78
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-77
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-77 CWE-78
Show all 11
via CWE-77
via CWE-77
via CWE-78
via CWE-77
via CWE-77
via CWE-77

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability (CVE-2025-1610) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_blacklist file, enabling remote attackers to execute arbitrary commands.

BSID: BS-2025-GLOBAL-235488-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-1610?
A critical vulnerability (CVE-2025-1610) in LB-LINK AC1900 Router 1.0.2 allows for OS command injection via the websGetVar function in the /goform/set_blacklist file, enabling remote attackers to execute arbitrary commands.
What is the CVSS score for CVE-2025-1610?
CVE-2025-1610 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 12.9%.
Is CVE-2025-1610 actively exploited?
No confirmed active exploitation of CVE-2025-1610 as of 2026-05-30.
How do I remediate CVE-2025-1610?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-1610?
CVE-2025-1610 affects: Lb-Link, Lb-Link.
Vulnerability Details
CVE IDCVE-2025-1610
BSIDBS-2025-GLOBAL-235488-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-02-24
Last Modified2025-11-04
ICS Relevance25%
Weakness (CWE)
Command InjectionOS Command Injection
SourceNVD
Official Description

A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by manipulating the 'mac/enable' argument in the websGetVar function, leading to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Lb-Link Ac1900 Firmware —
Lb-Link Ac1900 —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 535 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash35e482b104d5708ef86fb0373ae5deddfabecd858230c84ae9425347b837572a08423458157d2c0571f6c45ece825ca227d5587f6178b9df943ef43be5033c20
Related CVEs affecting Lb-Link
CVE-2025-1608 9.8 A vulnerability, which was classified as critical, was found in LB-LINK AC190... CVE-2023-26801 9.8 LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5... CVE-2024-33375 9.8 LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext ... CVE-2024-51431 9.8 LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/sha... CVE-2025-1609 9.8 A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified ...
View all Lb-Link CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →