Pix-Link LV-WR21Q auth bypass exposes cleartext passwords
Two vulnerabilities in Pix-Link LV-WR21Q routers allow unauthenticated attackers to retrieve cleartext passwords and cause denial of service on the admin panel.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities in Pix-Link LV-WR21Q router firmware after coordinating with the vendor, who did not respond with patch details. CVE-2025-12386 is an authentication bypass affecting the /goform/getHomePageInfo endpoint, allowing remote unauthenticated attackers to retrieve the access point's cleartext password. CVE-2025-12387 enables a denial of service attack against the administrator panel through a malformed language parameter in HTTP POST requests, causing the panel to become inaccessible until settings are manually reverted.
Firmware version V108_108 was confirmed vulnerable, though other versions were not tested and may also be affected. The DoS condition only impacts the administrative interface and does not affect core router functionality. The vendor was notified early in the disclosure process but provided no information about affected version ranges or remediation timelines.
The vulnerabilities were responsibly reported by Wojciech Cybowski. Organizations using Pix-Link LV-WR21Q routers should monitor for vendor patches and consider network-level mitigations to restrict administrative access until fixes are available.
Mentioned in this report
Detection guidance
Pix-Link Router Auth Bypass via getHomePageInfo Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the /goform/getHomePageInfo endpoint on Pix-Link LV-WR21Q routers, which can be queried without authentication to disclose the AP's cleartext password (CVE-2025-12386). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Pix-Link Router Auth Bypass via getHomePageInfo Endpoint
id: b047e6fe-9ffb-530c-9bcd-46a9cbeb9970
status: experimental
description: Detects HTTP requests to the /goform/getHomePageInfo endpoint on Pix-Link
LV-WR21Q routers, which allows unauthenticated retrieval of the access point's cleartext
password (CVE-2025-12386).
references:
- CERT Polska advisory CVE-2025-12386
logsource:
category: proxy
product: null
detection:
selection:
c-uri|contains: /goform/getHomePageInfo
filter_auth_header:
c-useragent|contains: internal-healthcheck
condition: selection and not filter_auth_header
fields:
- c-uri
- c-ip
- cs-method
- c-useragent
falsepositives:
- Legitimate router administration UI polling this endpoint after a valid login session
- Internal monitoring or health-check tools that legitimately query router status
pages
level: medium
tags:
- attack.t1190
- attack.initial-access
- cve.2025.12386
author: Vorant
Pix-Link Router Admin Panel DoS via Malformed Language Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP POST requests containing a malformed or unexpected 'language' parameter value targeting Pix-Link LV-WR21Q admin endpoints, consistent with the denial-of-service condition described in CVE-2025-12387. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Pix-Link Router Admin Panel DoS via Malformed Language Parameter
id: c20e2dce-7a9c-5cb1-8373-95f6a465d2fb
status: experimental
description: Detects HTTP POST requests with abnormal or malformed 'language' parameter
values sent to the Pix-Link LV-WR21Q administrative interface, which can crash or
lock the admin panel until settings are manually reverted (CVE-2025-12387).
references:
- CERT Polska advisory CVE-2025-12387
logsource:
category: proxy
product: null
detection:
selection:
cs-method: POST
c-uri|contains: language=
suspicious_value:
c-uri|re: language=[^a-zA-Z0-9_\-]{1,}
condition: selection and suspicious_value
fields:
- c-uri
- c-ip
- cs-method
falsepositives:
- Legitimate locale-switching requests using non-standard but valid language codes
- Automated configuration scripts posting language settings during provisioning
level: medium
tags:
- attack.t1499
- attack.impact
- cve.2025.12387
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-12386
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs