Arbitrary Code Execution in Time4 Popcorn

Executive Summary

CVE-2026-30612 is a command injection vulnerability affecting the LB-LINK AC1900_AZ2 Router (firmware version V1.0.2). It allows remote attackers to execute arbitrary code by injecting malicious shell commands through the bs_SetLimitCli_info function in the libshare.so library. The flaw occurs due to insufficient input validation in the mac parameter, which is passed unsafely to system-level commands via the bl_do_system function.

Useful 0 Not Useful 0

Detection Guidance

This CVE does not provide specific detection commands for the Time4 Popcorn vulnerability. However, for similar command injection flaws, monitor network traffic for suspicious HTTP POST requests to /goform/set_LimitClient_cfg with unusual parameters like mac, time1, or time2. Check logs for unexpected system command executions or reverse shell connections.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control of the affected router, enabling them to intercept network traffic, install malware, or launch further attacks on connected devices. The vulnerability is triggered via a crafted HTTP POST request to /goform/set_LimitClient_cfg, allowing remote code execution without authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is specific to a command injection flaw in a router firmware (LB-LINK AC1900_AZ2) rather than a data processing or storage system. However, if exploited, it could lead to unauthorized access to network resources, potentially compromising sensitive data and violating security policies.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware of the LB-LINK AC1900_AZ2 Router to the latest version to patch the vulnerability. Disable remote access to the router's web interface if not required. Monitor network traffic for unusual activity or unauthorized commands.

Useful 0 Not Useful 0