CVE-2025-45988

This vulnerability lets a remote attacker send specially crafted input to the router and have the router execute commands as if the attacker had direct access. Think of it like someone slipping a note into a mail slot that tells your building systems to do whatever they want—no password required. If an attacker can reach the router, they may be able to take control of your network and disrupt or manipulate traffic.

This matters if you run Blink routers with the specific firmware versions listed in this report. The issue does not require a login or user interaction to trigger it. The main question for you is reachability: it is a risk when the router’s vulnerable feature is reachable over the network (especially from the public internet); if it isn’t exposed, the risk is much lower.

Treat this as urgent because attackers can exploit it remotely without authentication by injecting commands through the 'cmd' parameter. There is a public proof-of-concept available, and the likelihood is predicted to be rising. This is not a “wait and see” situation—apply blocking/containment controls and check for the vendor fix now.

1. Confirm exposure (model + exact firmware):

   • Log into the router admin interface (or check device label/management page) and note the model and firmware version.
   • Determine whether it matches one of these affected versions: BL-WR9000 v2.4.9, BL-AC2100_AZ3 v1.0.4, BL-X10_AC8 v1.0.5, BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0, or BL-X26_DA3 v1.2.7.

2. Contain immediately if affected:

   • Restrict access so the router is not reachable from the public internet.
   • Use firewall/network filtering to limit which IP addresses can reach the router’s administrative or network-facing services (the vendor guidance emphasizes using firewall controls to restrict possible reachability).

3. Upgrade when available:

   • Check the vendor support/firmware update page for a release that addresses CVE-2025-45988.
   • Upgrade to the fixed firmware version provided by the vendor.
   • Re-check the firmware version after the upgrade to ensure the change actually took effect.

4. Workarounds if you cannot patch right away:

   • Keep the router behind stricter network controls (for example, no direct inbound access from the internet).
   • If the router is on a “guest” or separate segment, ensure only needed outbound access is allowed and inbound reachability is blocked.

5. What to monitor:

   • Look for unusual router reboots, new admin sessions, or unexpected changes in network behavior.
   • Review firewall logs for denied connection attempts aimed at the router, especially from unusual sources.

CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog for this CVE (based on the provided findings). No specific CISA due date was provided in the findings.

Severity is extremely high in scoring terms (reported CVSS 9.8), with the core finding being unauthenticated command injection (CWE-77) that allows arbitrary command execution on the router. The mechanism is manipulation of the 'cmd' parameter in the 'bs_SetCmd' function, enabling full system compromise. Attack requirements per findings: remote network access is possible, no authentication is required, and no user interaction is required. Exploitation status: a public proof-of-concept exists (1 known). KEV status: not listed in CISA KEV, so public availability/PoC is driving risk rather than confirmed cataloged exploitation from the provided sources. EPSS is a prediction and is rising (do not treat as confirmed exploitation). Mitigation guidance in the findings points to compensating controls via firewalling to restrict reachability.