Description
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pix-Link | LV-WR21Q | V108_108 | — |
| Pix-Link | WR21Q | V108_108 | — |
References
- https://cert.pl/en/posts/2026/01/CVE-2025-12386 third-party-advisory
- https://www.pix-link.com/lv-wr21q product
- https://github.com/wcyb/security_research exploit