CVE-2025-1608

LB-LINK AC1900 Router set_manpwd websGetVar os command injection

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.16.3Medium EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2025-02-24Updated 2025-11-04Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you use an LB-LINK AC1900 Router running firmware 1.0.2.
Limit router administration to trusted internal devices; do not expose its management page to the internet.
Ask LB-LINK or your supplier for a firmware update; no fixed version is currently available in the findings.
Use firewall and intrusion-detection or prevention controls to block suspicious router-management requests.

Some work to apply

What it is

From the CVE record

A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

In plain language

Written by AI from the record

LB-LINK AC1900 Router firmware 1.0.2 has a flaw that may let someone with router access run unwanted commands, so typical businesses should check and restrict access.

Authenticated remote OS command injection in LB-LINK AC1900 Router through the routepwd argument handled by websGetVar at /goform/set_manpwd.

If you're affected

Router settings changed
Network disruption
Limited data exposure
Unauthorized router commands

What is it

This is a weakness in the router's password-management function that can be abused to make the device follow unwanted instructions. Think of it like someone with access to the building's control panel being able to issue extra commands instead of only changing a password.

Who is affected

This matters to you if you use or run an LB-LINK AC1900 Router. It is only a risk if an attacker already has a router login.

How urgent is it

There is no record of active exploitation, no public exploit code on record, and it is not listed in CISA's known-exploited catalog. Treat this as routine router maintenance: restrict management access now and obtain a vendor update when available.

What to do — in detail

Confirm the model, firmware version, and whether the router management interface is reachable from untrusted networks or the internet. The reported affected version is 1.0.2; the findings do not provide a fixed firmware version or supported upgrade branch, so obtain a written remediation recommendation from LB-LINK or the supplying reseller before upgrading.

Until a vendor fix is available, permit administration only from a restricted internal management network, remove any internet-facing management access, and use firewall and IDS/IPS controls to detect or block suspicious requests to the router management interface. Review router administration logs for unexpected password-management requests, configuration changes, new administrator accounts, or unexplained reboots. CISA has not assigned a KEV remediation due date because this CVE is not in the KEV catalog.

Technical context

CVSS v3.1 is 6.3 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-77/CWE-78 OS command injection in websGetVar via the routepwd parameter at /goform/set_manpwd. CISA KEV does not list this CVE, and the exploit-source finding reports no public exploit code on record. EPSS is 10.2% (95th percentile) and rising, indicating elevated predicted likelihood rather than confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 572 days, from the signal feeds we watch.

2026-09-19EPSS band changelow → moderateepss band change
2026-08-03EPSS band changemoderate → low
2026-07-23EPSS band changemoderate → 0epss band change
2026-07-06EPSS band changelow → moderate
2026-06-30EPSS band changelow → moderate
2025-11-04Patch availablerecord updated

Affected products

LB-LINKcommercial
- ac1900 firmwareEmbeddedNetworking Infrastructure / router-switch
- AC1900 RouterEmbeddedNetworking Infrastructure / router-switch
Shenzhen Bilian Electronics Co., Ltd.commercial · CN
- LB-LINK BL-AC1900Network DeviceOn-premNetworking Infrastructure / router-switch

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Scored 6.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service