Read the docs
TI-2025-11364 Aliases CVE-2025-12387GHSA-292q-v67v-f66g

Denial of Service in Pix-Link LV-WR21Q

Priority HIGH 70CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes administrator panel to not work, resulting in DoS until the language settings is reverted to a correct value. The Denial of Service affects only the administrator panel and does not affect other router functionalities. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pix-LinkLV-WR21QV108_108—No fix listedCNA
Pix-LinkWR21QV108_108—No fix listedCNA
  • LV-WR21Q VendorPix-Link Affected V108_108 Fixed in — No fix listed CNA
  • WR21Q VendorPix-Link Affected V108_108 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12387
  2. 2026-10-03 Alias added: GHSA-292q-v67v-f66g

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-11363 Missing Authentication for Critical Endpoint in Pix-Link LV-WR21Q CVSS 4.0MEDIUM 6.9
  • TI-2020-14799 XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows… CVSS 3.1MEDIUM 6.1
  • TI-2019-08905 XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows… CVSS 3.0MEDIUM 6.1
  • TI-2021-19547 Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored… CVSS 3.1MEDIUM 5.4
  • TI-2021-19546 Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences