Pix-Link LV-WR21Q/WR21Q V108_108 Language unusual condition

Summaryinfo

A vulnerability categorized as problematic has been discovered in Pix-Link LV-WR21Q and WR21Q V108_108. This vulnerability affects unknown code of the component Language Module. Executing a manipulation can lead to unusual condition. The identification of this vulnerability is CVE-2025-12387. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Pix-Link LV-WR21Q and WR21Q V108_108 and classified as problematic. This vulnerability affects an unknown functionality of the component Language Module. The manipulation with an unknown input leads to a unusual condition vulnerability. The CWE definition for the vulnerability is CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes administrator panel to not work, resulting in DoS until the language settings is reverted to a correct value. The Denial of Service affects only the administrator panel and does not affect other router functionalities. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The weakness was shared by Wojciech Cybowski. The advisory is available at cert.pl. This vulnerability was named CVE-2025-12387 since 10/28/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/27/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Pix-Link

Name

• LV-WR21Q
• WR21Q

Version

• V108_108

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion