Description
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
References (3)
Core 3
Core References
Various Sources third-party-advisory
https://cert.pl/en/posts/2026/01/CVE-2025-12386
Various Sources product
https://www.pix-link.com/lv-wr21q
Scores
CVSS v4
6.9
EPSS
0.0012
EPSS Percentile
31.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (2)
Pix-Link/LV-WR21Q
V108_108
Pix-Link/WR21Q
V108_108
Published
Jan 27, 2026
Tracked Since
Feb 18, 2026