CVE-2026-35867
Quick assessment
Affected
LB-LINK AC1900 firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 LB-LINK 路由器 AC1900_AZ2 V1.0.2 的 库中， 函数存在命令注入漏洞。如果攻击者能够发起 请求，但尚未拥有设备的管理员权限，则可通过插入 shell 元字符来利用该漏洞。
Possible ATT&CK Techniques 1 AI
T1059.004 · Unix Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-35867
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| LB-LINK | AC1900 firmware | 1.0.2 | - |
|
II. Public POCs for CVE-2026-35867
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-35867
请登录查看更多情报信息。
Proof of Concept for CVE-2026-35867 (1)
IV. Related Vulnerabilities
Same vendor: LB-LINK
-
CVE-2026-19971
LB-Link WR1210M Backup Endpoint backup.cgi main missing auth -
CVE-2026-19901
LB-LINK X-PRO easycwmp hard-coded credentials -
CVE-2026-19900
LB-LINK X-PRO shadow hard-coded credentials -
CVE-2026-4228
LB-LINK BL-WR9000 set_wifi sub_458754 command injection -
CVE-2026-4227
LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflo
Same weakness: CWE-78
-
CVE-2026-90618
GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime. -
CVE-2026-90617
GH05TCREW PentestAgent MCP HTTP Server main.py run_task os c -
CVE-2026-90770
Spug through 3.4.0 Remote Code Execution via ping_check -
CVE-2026-90492
webgjc web_robot web.py controller_recover os command inject -
CVE-2026-90444
文件传输接口命令注入导致认证用户权限提升
V. Comments for CVE-2026-35867
No comments yet