Vulnerability Description
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/01/CVE-2025-12386
- https://github.com/wcyb/security_research
- https://www.pix-link.com/lv-wr21q
FAQ
What is CVE-2025-12386?
CVE-2025-12386 is a documented vulnerability. Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to ...
How severe is CVE-2025-12386?
CVSS scoring is not yet available for CVE-2025-12386. Check NVD for updates.
Is there a patch for CVE-2025-12386?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.