What’s Vulnerable › Vulnerabilities

CVE-2025-12386: Missing Authentication for Critical Endpoint in Pix-Link LV-WR21Q

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-306

Description

Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected products

• Pix-Link LV-WR21Q: V108_108
• Pix-Link WR21Q: V108_108

References

• https://cert.pl/en/posts/2026/01/CVE-2025-12386
• https://github.com/wcyb/security_research
• https://www.pix-link.com/lv-wr21q

Get alerted when CVE-2025-12386 or the next vulnerability affects your stack