Command Injection in LB-link Router AC2100_AZ3

Executive Summary

This is a Command Injection vulnerability in the LB-link AC2100_AZ3 Router (firmware V1.0.4). It exists in the bs_SetLimitCli_info function within the libshare.so library due to insufficient validation of user input. Attackers can inject malicious shell commands via the mac parameter, which is then executed by the system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious HTTP POST requests targeting the set_LimitClient_cfg endpoint with unusual parameters like the mac field containing shell commands. Check router logs for unexpected system command executions via libshare.so or bl_do_system. Use tools like tcpdump or Wireshark to inspect traffic for crafted payloads containing commands such as telnetd or other shell metacharacters.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain remote shell access to the router by exploiting this flaw. This allows them to execute arbitrary commands, potentially taking control of the device, intercepting network traffic, or using it as a foothold to attack other systems on the network.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to the latest version if a patch is available. Disable remote access to the web server if not required. Restrict access to the set_LimitClient_cfg endpoint by implementing network-level controls. Monitor for unauthorized system command executions and block suspicious traffic patterns. Consider isolating the router from critical networks until mitigation is confirmed.

Useful 0 Not Useful 0