CVE-2025-45988

This vulnerability lets a remote attacker send specially crafted input to the router and have the router execute commands as if the attacker had direct access. Think of it like someone slipping a note into a mail slot that tells your building systems to do whatever they want—no password required. If an attacker can reach the router, they may be able to take control of your network and disrupt or manipulate traffic.

This matters if you run Blink routers with the specific firmware versions listed in this report. The issue does not require a login or user interaction to trigger it. The main question for you is reachability: it is a risk when the router’s vulnerable feature is reachable over the network (especially from the public internet); if it isn’t exposed, the risk is much lower.

Treat this as urgent because attackers can exploit it remotely without authentication by injecting commands through the 'cmd' parameter. There is a public proof-of-concept available, and the likelihood is predicted to be rising. This is not a “wait and see” situation—apply blocking/containment controls and check for the vendor fix now.