CVE-2025-29062

The command injection vulnerability (CWE-77) occurs in the web service based on the GoAhead server. An attacker can pass malicious data in the time1 and time2 parameters of the set_LimitClient_cfg function call, which are then processed without proper validation and sanitization. This enables injection and execution of arbitrary system commands in the context of the running service.

An attacker can remotely gain full control over the device by executing arbitrary code without authentication. As a result, it is possible to compromise the confidentiality, integrity, and availability of the system and the entire supported network.

Security patches available from the manufacturer should be applied in accordance with the references. As a temporary measure, it is recommended to restrict access to the administrative interface only to trusted local networks and to block access from the Internet using a firewall.

LB-Link BL-AC2100 with firmware version V1.0.4 and earlier