# Pix-Link LV-WR21Q auth bypass exposes cleartext passwords

Published: 2026-01-27 · Severity: medium
Canonical: https://vorant.io/reports/e51d6a87-34d7-523b-b444-0b6d11cb4d65/pix-link-lv-wr21q-auth-bypass-exposes-cleartext-passwords

> Two vulnerabilities in Pix-Link LV-WR21Q routers allow unauthenticated attackers to retrieve cleartext passwords and cause denial of service on the admin panel.

CERT Polska disclosed two vulnerabilities in Pix-Link LV-WR21Q router firmware after coordinating with the vendor, who did not respond with patch details. CVE-2025-12386 is an authentication bypass affecting the /goform/getHomePageInfo endpoint, allowing remote unauthenticated attackers to retrieve the access point's cleartext password. CVE-2025-12387 enables a denial of service attack against the administrator panel through a malformed language parameter in HTTP POST requests, causing the panel to become inaccessible until settings are manually reverted.

Firmware version V108_108 was confirmed vulnerable, though other versions were not tested and may also be affected. The DoS condition only impacts the administrative interface and does not affect core router functionality. The vendor was notified early in the disclosure process but provided no information about affected version ranges or remediation timelines.

The vulnerabilities were responsibly reported by Wojciech Cybowski. Organizations using Pix-Link LV-WR21Q routers should monitor for vendor patches and consider network-level mitigations to restrict administrative access until fixes are available.

## Mentioned in this report

- Vulnerabilities: CVE-2025-12386, CVE-2025-12387

## Detection guidance (public sample)

### Pix-Link Router Auth Bypass via getHomePageInfo Endpoint

ATT&CK: T1190

Detects HTTP requests to the /goform/getHomePageInfo endpoint on Pix-Link LV-WR21Q routers, which can be queried without authentication to disclose the AP's cleartext password (CVE-2025-12386). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Pix-Link Router Auth Bypass via getHomePageInfo Endpoint
id: b047e6fe-9ffb-530c-9bcd-46a9cbeb9970
status: experimental
description: Detects HTTP requests to the /goform/getHomePageInfo endpoint on Pix-Link
  LV-WR21Q routers, which allows unauthenticated retrieval of the access point's cleartext
  password (CVE-2025-12386).
references:
- CERT Polska advisory CVE-2025-12386
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains: /goform/getHomePageInfo
  filter_auth_header:
    c-useragent|contains: internal-healthcheck
  condition: selection and not filter_auth_header
fields:
- c-uri
- c-ip
- cs-method
- c-useragent
falsepositives:
- Legitimate router administration UI polling this endpoint after a valid login session
- Internal monitoring or health-check tools that legitimately query router status
  pages
level: medium
tags:
- attack.t1190
- attack.initial_access
- cve.2025.12386
author: Vorant
```

### Pix-Link Router Admin Panel DoS via Malformed Language Parameter

ATT&CK: T1499

Detects HTTP POST requests containing a malformed or unexpected 'language' parameter value targeting Pix-Link LV-WR21Q admin endpoints, consistent with the denial-of-service condition described in CVE-2025-12387. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Pix-Link Router Admin Panel DoS via Malformed Language Parameter
id: c20e2dce-7a9c-5cb1-8373-95f6a465d2fb
status: experimental
description: Detects HTTP POST requests with abnormal or malformed 'language' parameter
  values sent to the Pix-Link LV-WR21Q administrative interface, which can crash or
  lock the admin panel until settings are manually reverted (CVE-2025-12387).
references:
- CERT Polska advisory CVE-2025-12387
logsource:
  category: proxy
  product: null
detection:
  selection:
    cs-method: POST
    c-uri|contains: language=
  suspicious_value:
    c-uri|re: language=[^a-zA-Z0-9_\-]{1,}
  condition: selection and suspicious_value
fields:
- c-uri
- c-ip
- cs-method
falsepositives:
- Legitimate locale-switching requests using non-standard but valid language codes
- Automated configuration scripts posting language settings during provisioning
level: medium
tags:
- attack.t1499
- attack.impact
- cve.2025.12387
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-12386

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e51d6a87-34d7-523b-b444-0b6d11cb4d65/pix-link-lv-wr21q-auth-bypass-exposes-cleartext-passwords.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup