CVE-2026-35867

Received Received - Intake

Command Injection in LB-LINK AC1900_AZ2 Router

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-35867

EUVD

EUVD-2026-77124

Affected Vendors & Products

Vendor	Product	Version / Range
lb-link	ac1900_az2	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a Command Injection vulnerability in the LB-LINK router AC1900_AZ2 V1.0.2. It exists in the bs_SetLimitCli_info function within the libshare.so library. The flaw allows an attacker to inject shell commands via special characters if they can make a POST request to /goform/set_LimitClient_cfg without administrative access.

Detection Guidance

This vulnerability requires network access to the LB-LINK AC1900_AZ2 router and involves a POST request to /goform/set_LimitClient_cfg with shell metacharacters. Detection involves monitoring for unusual POST requests to this endpoint or inspecting logs for command injection attempts in the libshare.so library.

Impact Analysis

An attacker could execute unauthorized commands on the router, potentially altering its configuration, stealing data, or using it as a pivot point to attack other devices on the network. This could lead to loss of control over the router and compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to network traffic or sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using this router may fail compliance audits if the flaw is exploited to access protected information.

Mitigation Strategies

Immediately restrict access to the router's administrative interface and disable remote management features. Update the router firmware to the latest version if an official patch is available. Monitor network traffic for unusual POST requests to /goform/set_LimitClient_cfg endpoints.

Hi! I’m here to help you understand CVE-2026-35867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70