Bl Ac2100 Az3 Firmware CVE-2025-45986

This vulnerability presents CRITICAL real-world risk across multiple dimensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity, no privileges required, and no user interaction needed—making it trivially exploitable by any network-adjacent attacker or exposed WAN interface. The vulnerability affects 8 distinct router models across various product lines, suggesting widespread deployment in consumer and small business environments. Without KEV/POC availability data explicitly provided, the actual exploitation probability cannot be definitively assessed, but the straightforward nature of command injection in a web-accessible parameter suggests exploitation is trivial and likely already weaponized. This is NOT a theoretical high-CVSS-low-risk issue; it is a practical, high-impact vulnerability affecting network infrastructure with direct pathways to complete system compromise. The presence of multiple affected versions with no indication of unified patch status suggests delayed remediation timelines across the product line, elevating real-world risk further.

An attacker on the same network segment (or WAN-accessible network) crafts an HTTP request to the router's web interface targeting the bs_SetMacBlack function with a malicious 'mac' parameter. Example payload: mac=AA:BB:CC:DD:EE:FF; cat /etc/shadow > /tmp/exfil.txt;. The router processes this input without validation and passes it directly to a system shell command, executing the injected commands with root privileges. The attacker gains complete control of the router, enabling them to: (a) exfiltrate configuration data and credentials, (b) pivot into the internal network via the compromised gateway, (c) establish persistent backdoors for botnet recruitment, (d) perform man-in-the-middle attacks on all network traffic, or (e) completely disable network connectivity. No authentication is required, and the attack is triggerable from any network-accessible position within seconds.