CVE-2026-35868: Command Injection
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.
Affected Software
Event History
Frequently Asked Questions
Which component should be checked when assessing exposure?
The affected function is bs_SetLimitCli_info in the router's libshare.so library. The supplied data identifies LB-link Router AC2100_AZ3 V1.0.4 as affected.
What must an attacker be able to do to exploit this issue?
An attacker needs to supply crafted input to the vulnerable parameter processed by bs_SetLimitCli_info. Shell metacharacters or payloads can then be passed into a system-level command execution context.
What is the potential impact of successful exploitation?
Successful exploitation can result in execution of arbitrary operating system commands on the affected router.