Pix-Link LV-WR21Q router firmware contains two vulnerabilities allowing unauthenticated…
Pix-Link LV-WR21Q router firmware contains two vulnerabilities allowing unauthenticated credential disclosure and denial-of-service against the admin panel.
CERT Polska disclosed two vulnerabilities affecting the Pix-Link LV-WR21Q router firmware version V108_108. CVE-2025-12386 is an authentication bypass allowing remote unauthenticated attackers to access the /goform/getHomePageInfo endpoint and retrieve cleartext access point passwords. CVE-2025-12387 enables remote attackers to trigger a denial-of-service condition by submitting malformed language parameters via HTTP POST, rendering the administrator panel inoperable until settings are manually reverted. The DoS does not affect other router functions.
The vendor was notified early in the coordinated disclosure process but did not respond with details about affected versions or remediation. Only firmware version V108_108 has been confirmed vulnerable through testing; other versions may also be affected. The vulnerabilities were responsibly reported by Wojciech Cybowski. Organizations using Pix-Link LV-WR21Q routers should monitor for vendor patches and consider network segmentation to limit exposure of management interfaces.
Mentioned in this report
Detection guidance
Unauthenticated Access to Pix-Link getHomePageInfo Endpoint (CVE-2025-12386)
Detects HTTP GET requests to the Pix-Link router /goform/getHomePageInfo endpoint, which discloses cleartext AP credentials without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to Pix-Link getHomePageInfo Endpoint
id: 93acf260-8075-5f83-bcdc-98228dc97711
status: experimental
description: Detects requests to the vulnerable /goform/getHomePageInfo endpoint on
Pix-Link LV-WR21Q routers, exploited via CVE-2025-12386 to bypass authentication
and retrieve plaintext WiFi credentials.
references:
- CERT Polska advisory on Pix-Link LV-WR21Q CVE-2025-12386
author: Vorant
tags:
- attack.t1190
- attack.t1552.001
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|contains: /goform/getHomePageInfo
condition: selection
fields:
- src_ip
- c-uri
- cs-method
- sc-status
falsepositives:
- Legitimate administrative access to the router's built-in status page from an authenticated
management session
- Network scanners or monitoring tools cataloguing router web interfaces
level: high
Malformed Language Parameter DoS Attempt Against Pix-Link Admin Panel (CVE-2025-12387)
Detects POST requests submitting malformed or oversized language parameters to Pix-Link router goform endpoints, which can crash the admin panel and cause a denial-of-service condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malformed Language Parameter DoS Attempt Against Pix-Link Router
id: 17085fe6-f778-5738-8cbf-4f13f3b4e330
status: experimental
description: Detects HTTP POST requests to Pix-Link LV-WR21Q goform endpoints containing
a language parameter value outside the expected short set of language codes, consistent
with exploitation of CVE-2025-12387 to render the admin panel inoperable. Repeated
occurrences from the same source in a short time window increase confidence this
is an active DoS attempt rather than a misconfiguration.
references:
- CERT Polska advisory on Pix-Link LV-WR21Q CVE-2025-12387
author: Vorant
tags:
- attack.t1498
logsource:
category: proxy
detection:
selection:
cs-method: POST
c-uri|contains:
- /goform/
c-uri|contains|all:
- language
filter:
c-uri|re: .*language=(en|zh|fr|de|es|ja|ru|it|pt|ko)([&#]|$).*
condition: selection and not filter
fields:
- src_ip
- c-uri
- cs-method
- sc-status
falsepositives:
- Legitimate firmware localization changes using an unlisted but valid language code
- Automated configuration tools setting custom or extended language values
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-12386
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free