CVE-2025-12386: Pix-Link Lv-WR21Q

Medium severity, CVSS 6.9. EPSS: 0.8% chance of exploitation in the next 30 days.

Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected products

• Pix-Link Lv-WR21Q: version V108_108 only
• Pix-Link WR21Q: version V108_108 only

Published 2026-01-27. Last modified 2026-06-17.