Description

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-13T22:16:59.473Z",
  "pubdate": "2026-09-13T22:16:59.473Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the LB-LINK router AC1900_AZ2 V1.0.2. The flaw resides within the bs_SetLimitCli_info function located in the libshare.so library. This vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges by injecting malicious shell metacharacters via the POST /goform/set_LimitClient_cfg endpoint.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected device. Successful exploitation grants the attacker the ability to bypass authentication mechanisms, potentially leading to a full device compromise. The attack vector is remotely exploitable over the network, requiring no prior administrative privileges on the target router. This flaw is primarily due to improper sanitization of user-supplied input before passing it to system-level execution functions, facilitating remote code execution (RCE) scenarios.",
  "technicalDetails": "The vulnerability is localized to the bs_SetLimitCli_info function within the libshare.so dynamic library, which is responsible for processing configuration parameters related to client traffic limits. The root cause of this security flaw is the failure to adequately sanitize input parameters processed by the POST /goform/set_LimitClient_cfg interface. Specifically, the application fails to filter or escape shell metacharacters before incorporating user input into internal system calls or shell commands.\nThe attack flow begins when an attacker sends a specially crafted POST request to the /goform/set_LimitClient_cfg endpoint. This request contains malicious payloads embedded within the parameters expected by the bs_SetLimitCli_info function. By leveraging shell metacharacters such as backticks (`), semicolons (;), or pipes (|), an attacker can terminate the intended command and append arbitrary system instructions. Because the application logic executes these commands with root or high-level system privileges, the injected commands are processed by the underlying operating system's shell interpreter.\nThe exploitation process is as follows: first, the attacker identifies the parameter fields in the POST body that are passed directly to the vulnerable bs_SetLimitCli_info function. Second, the attacker constructs a payload that injects commands, such as spawning a reverse shell or modifying configuration files. Third, the crafted request is sent to the target router. Upon receipt, the router's web server parses the request and passes the tainted data to the vulnerable library function. Finally, the system executes the malicious command, granting the attacker control over the device environment.\nThis vulnerability highlights a lack of secure coding practices regarding input validation and the use of dangerous system-level APIs. The absence of robust input filtering allows attackers to escape the intended application context and interact directly with the underlying Linux shell. Post-exploitation impact includes persistent unauthorized access, the ability to pivot into internal networks, exfiltration of sensitive device data, and the potential for a complete device takeover, turning the router into a node for larger botnet operations or localized network eavesdropping."
}