We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to inject arbitrary JavaScript, which is executed in the context of the router's origin when the crafted URL is accessed. The issue requires user interaction to exploit.
Reserved 2025-06-16 | Published 2025-07-31 | Updated 2025-07-31 | Assigner mitrewww.lb-link.com/CPE300M-AX300-4G-LTE-Router-pd502775568.html
www.zyenra.com/blog/xss-in-lb-link-lb-cpe300m.html
Support options
