Command Injection Vulnerability in LB-LINK Router AC1900_AZ2

CVE-2026-35867

What is CVE-2026-35867?

A command injection vulnerability has been identified in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK AC1900_AZ2 router. This vulnerability allows an attacker, without prior administrative access, to exploit the device by sending specially crafted POST requests to the endpoint '/goform/set_LimitClient_cfg'. The ability to inject shell metacharacters can lead to unauthorized command execution, compromising the security of the device.

References