CVE-2025-12387
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
27/01/2026
Last modified:
27/01/2026
Description
A vulnerability in the Pix-Link LV-WR21Q router&#39;s language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted HTTP POST request containing non-existing language parameter. This renders the server unable to serve correct lang.js file, which causes administrator panel to not work, resulting in DoS until the language settings is reverted to a correct value. The Denial of Service affects only the administrator panel and does not affect other router functionalities.<br />
<br />
The vendor was notified early about this vulnerability, but didn&#39;t respond with the details of vulnerability or vulnerable version range. Only version V108_108 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM