Command Injection in LB-link Router AC450M

Executive Summary

This is a Command Injection vulnerability in the LB-LINK AC450M Router V4.0.0. It exists in the bs_SetLimitCli_info function within the libshare.so library. The flaw occurs because user input is not properly validated or sanitized before being passed to system-level command execution. Attackers can inject malicious shell commands via parameters like mac, time1, or time2, which are then executed unsafely.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your LB-link AC450M router is running version V4.0.0. Monitor network traffic for HTTP POST requests to the /goform/set_LimitClient_cfg endpoint. Look for unusual parameters like mac, time1, or time2 being manipulated. Use tools like Wireshark to capture and inspect traffic for suspicious payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary operating system commands on the router. This could allow them to take control of the device, install malware, steal data, or use the router as a pivot point to attack other systems on the network. The vulnerability can be triggered remotely via a crafted HTTP POST request.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Compromised routers may expose sensitive network traffic or stored data, resulting in non-compliance with data protection regulations and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to the latest version if an update is available. Disable remote administration features if not needed. Block external access to the /goform/set_LimitClient_cfg endpoint using firewall rules. Monitor network traffic for signs of exploitation, such as unexpected telnet connections on non-standard ports.

Useful 0 Not Useful 0