LB-Link AC2100 CVE-2026-35868

Exploitation requires the ability to send input to the client-limit configuration function (bs_SetLimitCli_info) exposed by the router's management/back-end interface on an AC2100_AZ3 running firmware V1.0.4, and injection of shell metacharacters into the affected parameter. The input CVSS vector claims AV:N/PR:N/UI:N (remote, no authentication, no user interaction), which would mean no special conditions against a reachable device; however, because the affected feature is an administrative client-limiting setting, exploitation is realistically limited to attackers who can reach the management interface and, likely, who are authenticated to it - verify the actual authentication requirement with the vendor/write-up. Practical limiting factors: management interface must be network-reachable from the attacker (often LAN-only unless remote administration is enabled), and the specific firmware version V1.0.4 must be present.

Signals are mixed. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) implying trivial remote unauthenticated RCE, but the described feature - setting client limits - is characteristically an administrative management function, so the PR:N assumption should be verified; many comparable router command-injection flaws require access to (or authentication against) the web management interface, which would lower real-world exploitability. EPSS is only 0.54% (43rd percentile) and the CVE is not in CISA KEV, indicating no confirmed active, widespread exploitation to date. Countering that, a dedicated public disclosure write-up exists, command injection on embedded routers is highly reliable and often trivially automatable once the endpoint is reachable, and SOHO routers are frequently internet-exposed and mass-scanned for botnet recruitment. On balance this is a genuine high-priority issue for anyone running this specific device, particularly where the management interface is reachable from untrusted networks - the primary uncertainty is authentication/exposure, not the severity of the outcome.

An attacker who can reach the router's management interface submits a request to the client-limit configuration handler with a crafted value containing shell metacharacters (e.g., a payload like ; followed by a command). libshare.so's bs_SetLimitCli_info passes the value into a system-level command without sanitization, executing the attacker's command as root, which can be used to open a reverse shell, add the device to a botnet, or pivot into the internal network. A public technical write-up describing the vulnerable function increases the likelihood of reliable exploitation.