CVE-2025-9580

Name of the Vulnerable Software and Affected Versions LB-LINK BL-X26 version 1.2.8

Description A security issue has been identified in LB-LINK BL-X26 version 1.2.8 related to the HTTP Handler component. Manipulation of the mac argument in the /goform/set blacklist file can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed.

Recommendations As a temporary workaround, consider restricting access to the /goform/set blacklist file to minimize the risk of exploitation. Avoid using the mac parameter in the affected /goform/set blacklist API endpoint until the issue is resolved.