CVE-2025-57685 is a command injection vulnerability in several LB-Link router models. Attackers can exploit the /goform/set_serial_cfg interface to execute arbitrary commands with the highest privileges on the device without any authorization. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerability has a CVSS v3.1 base score of 8.8 with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation results in unauthorized remote command execution with highest privileges on affected LB-Link routers. This can lead to full compromise of the device, including control over network traffic, device configuration, and potential pivoting to internal networks. Confidentiality, integrity, and availability of the device and connected networks are severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router management interfaces, especially the /goform/set_serial_cfg endpoint, to trusted networks only. Monitor for unusual activity and consider network segmentation to limit exposure.