Pix-Link LV-WR21Q Unauthenticated Access & DoS Vulnerabilities (CVE-2025-12386/12387)

Vulnerability Key Information Vulnerability Details CVE ID: CVE-2025-12386 - Release Date: January 27, 2026 - Vendor: Pix-Link - Product: LV-WR21Q - Affected Version: V108_108 - Vulnerability Type: Missing Authentication for Critical Function (CWE-306) - Report Source: Reported to CERT Polska CVE ID: CVE-2025-12387 - Release Date: January 27, 2026 - Vendor: Pix-Link - Product: LV-WR21Q - Affected Version: V108_108 - Vulnerability Type: Improper Check for Unusual or Exceptional Conditions (CWE-754) - Report Source: Reported to CERT Polska Description CERT Polska received reports regarding vulnerabilities in the firmware of the Pix-Link LV-WR21Q and participated in the vulnerability disclosure coordination. CVE-2025-12386: The Pix-Link LV-WR21Q does not implement any form of authentication for the endpoint . A remote, unauthenticated attacker can exploit this endpoint to, for example, retrieve the access point's plaintext password. CVE-2025-12387: A vulnerability in the language module of the Pix-Link LV-WR21Q router allows remote attackers to trigger a Denial of Service (DoS) by sending a specially crafted HTTP POST request containing a non-existent language parameter. This causes the server to fail in properly serving the file, resulting in the management panel becoming non-functional until the language setting is restored to a valid value. The DoS affects only the management panel and does not impact other router functionalities. Acknowledgments Thank you to Wojciech Cybowski for submitting a responsible vulnerability report. Notes The vendor was notified in advance about these vulnerabilities but did not respond with details regarding the vulnerabilities or the affected version range. Only version V108_108 was tested and confirmed to be vulnerable; other versions were not tested and may also be vulnerable.

Goal Reached Thanks to every supporter — we hit 100%!

Pix-Link LV-WR21Q Unauthenticated Access & DoS Vulnerabilities (CVE-2025-12386/12387)