CVE-2025-1608 is a medium severity OS command injection flaw in the LB-LINK AC1900 router, version 1.0.2. The routepwd argument to /goform/set_manpwd is passed on unsafely. NVD scores it 6.3. No fix is named, so reduce exposure of the admin interface.
What's affected
The record lists LB-LINK AC1900 firmware 1.0.2. The weak code is the handler for /goform/set_manpwd, reached through the routepwd argument. No fixed firmware version is named in the record or in the references we could read. Check the vendor's download and support pages for newer firmware, and treat any claim of a fix as unconfirmed until the vendor says which release carries it. The record says the vendor was contacted early about this disclosure but did not respond in any way.
How to check if you're exposed
Read the firmware version from the router's admin page and compare it with the version above. Then check whether the admin interface answers from the internet.
nmap -Pn -p 80,443,8080,8443 YOUR_ROUTER_PUBLIC_IP
Run it from outside your network. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) shows the attack needs a low privilege account and no user interaction. Because a login is needed, weak or shared admin passwords are the main risk factor. Also check whether a diagnostic page like the one named in the CVE is reachable from user networks.
What to do now
- List every LB-LINK AC1900 on your networks and record each firmware version.
- Disable remote management from the WAN side and allow the admin page only from a trusted management network.
- Set a long unique admin password and remove any default or shared logins.
- Contact the vendor for a fixed firmware and apply it as soon as one is confirmed.
- If no fix is offered, plan replacement with a supported device, and keep the unit away from sensitive network paths until then.
- Watch the router for unexpected configuration changes, new processes or odd outbound traffic.
Why it matters
The weakness is CWE-77, command injection, shown in the record as OS command injection and grouped under CWE-74, injection. The device takes a value from a web form, then builds a system command from it. If the value is not checked, the router's shell can be asked to do more than the form intended.
Routers sit between your network and the internet, so code execution on one is serious. The record says the exploit is public. This CVE is not on the CISA KEV list, so the record shows no confirmed use in the wild. The scores in the record are modest (6.3), but low scores on edge devices often understate the value of the foothold.
Quick check
Does this need a login?
Per the CVSS vector it needs a low privilege account. Even so, shared admin passwords make that barrier thin.
Is a fixed firmware available?
The record does not name one. Check the vendor's support site and treat the device as unpatched until a release note confirms a fix.
Sources
Last reviewed: 19 October 2026.
