https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4228.htmlhttps://patchthecve.com/cve/CVE-2026-4228.htmlWed, 17 Jun 2026 10:56:15 +0000MEDIUM 6.3: A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about thihttps://patchthecve.com/cve/CVE-2026-4227.htmlhttps://patchthecve.com/cve/CVE-2026-4227.htmlWed, 17 Jun 2026 10:56:15 +0000HIGH 8.8: A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be uhttps://patchthecve.com/cve/CVE-2026-4226.htmlhttps://patchthecve.com/cve/CVE-2026-4226.htmlWed, 17 Jun 2026 10:56:15 +0000HIGH 8.8: A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the publichttps://patchthecve.com/cve/CVE-2025-10773.htmlhttps://patchthecve.com/cve/CVE-2025-10773.htmlWed, 17 Jun 2026 08:28:57 +0000HIGH 8.8: A security flaw has been discovered in B-Link BL-AC2100 up to 1.0.3. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg of the component Web Management Interface. The manipulation of the argument Type results in stack-based buffer overflow. The attack may be perhttps://patchthecve.com/cve/CVE-2025-57278.htmlhttps://patchthecve.com/cve/CVE-2025-57278.htmlWed, 17 Jun 2026 09:42:59 +0000HIGH 8.8: The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or verihttps://patchthecve.com/cve/CVE-2025-9580.htmlhttps://patchthecve.com/cve/CVE-2025-9580.htmlSat, 26 Sep 2026 00:10:00 +0000MEDIUM 6.3: A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been discloshttps://patchthecve.com/cve/CVE-2025-7565.htmlhttps://patchthecve.com/cve/CVE-2025-7565.htmlWed, 17 Jun 2026 10:05:14 +0000MEDIUM 5.3: A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible https://patchthecve.com/cve/CVE-2025-7564.htmlhttps://patchthecve.com/cve/CVE-2025-7564.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local access is required to approach this attahttps://patchthecve.com/cve/CVE-2025-29063.htmlhttps://patchthecve.com/cve/CVE-2025-29063.htmlWed, 17 Jun 2026 09:05:06 +0000CRITICAL 9.8: An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.https://patchthecve.com/cve/CVE-2025-29062.htmlhttps://patchthecve.com/cve/CVE-2025-29062.htmlWed, 17 Jun 2026 09:05:05 +0000CRITICAL 9.8: An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice.https://patchthecve.com/cve/CVE-2025-1610.htmlhttps://patchthecve.com/cve/CVE-2025-1610.htmlWed, 17 Jun 2026 08:39:27 +0000MEDIUM 6.3: A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has behttps://patchthecve.com/cve/CVE-2025-1609.htmlhttps://patchthecve.com/cve/CVE-2025-1609.htmlWed, 17 Jun 2026 08:39:27 +0000MEDIUM 6.3: A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has behttps://patchthecve.com/cve/CVE-2025-1608.htmlhttps://patchthecve.com/cve/CVE-2025-1608.htmlWed, 17 Jun 2026 08:39:27 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd  leads to os command injection. It is possible to launch the attack remotely. The exploit has beehttps://patchthecve.com/cve/CVE-2024-51431.htmlhttps://patchthecve.com/cve/CVE-2024-51431.htmlWed, 17 Jun 2026 08:05:42 +0000CRITICAL 9.8: LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.https://patchthecve.com/cve/CVE-2024-33373.htmlhttps://patchthecve.com/cve/CVE-2024-33373.htmlWed, 17 Jun 2026 07:31:42 +0000MEDIUM 6.3: An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.https://patchthecve.com/cve/CVE-2024-33377.htmlhttps://patchthecve.com/cve/CVE-2024-33377.htmlWed, 17 Jun 2026 07:31:43 +0000HIGH 8.1: LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.https://patchthecve.com/cve/CVE-2024-33375.htmlhttps://patchthecve.com/cve/CVE-2024-33375.htmlWed, 17 Jun 2026 07:31:42 +0000CRITICAL 9.8: LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.