LB-LINK AC1900 EUVD-2026-77124

Exploitation requires the attacker to be on the adjacent network (LAN or Wi-Fi segment) where the router's HTTP management interface is reachable. The primary condition per the description is the ability to issue a POST request to /goform/set_LimitClient_cfg - the description explicitly notes this applies when the actor does NOT already have administrative access, suggesting either a missing authentication check on that endpoint or accessibility to lower-privilege authenticated sessions. The CVSS PR:H rating contradicts this framing; true exploitation conditions are ambiguous and require firmware verification. Attack complexity is rated High (CVSS AC:H), though this may reflect the adjacency and endpoint-reachability prerequisites rather than technical injection complexity. The vulnerability is limited to the specific firmware version V1.0.2 on the AC1900_AZ2 model and requires physical or network adjacency to the device's management plane.

The official CVSS 3.1 score of 3.1 (Low) is driven by AV:A (adjacent network), AC:H (high complexity), and PR:H (high privileges), yielding negligible real-world severity as scored. However, the description creates a direct contradiction: it specifies that the attack succeeds when an actor can reach the endpoint but does NOT already have administrative access - implying the endpoint may lack adequate authentication enforcement in certain deployment scenarios or is accessible to lower-privilege roles. If the effective PR is L or N, the severity would rise substantially toward High or Critical on the adjacent-network vector. The AC:H rating may also be overstated for a straightforward shell-metacharacter injection. No EPSS data was provided. The CVE has no CISA KEV listing, and no public exploit beyond the researcher's GitHub advisory has been identified. Real-world risk is low due to the niche, consumer-grade product footprint, adjacency requirement, and no known active exploitation, but the internal scoring contradiction warrants independent verification against the actual firmware before dismissing this as truly low risk.

An attacker on the local network (e.g., a guest Wi-Fi user or LAN-connected host) who can submit HTTP POST requests to /goform/set_LimitClient_cfg injects shell metacharacters into a parameter processed by bs_SetLimitCli_info, causing the router firmware to execute arbitrary OS commands without administrative credentials. The outcome is OS command execution on the router, potentially enabling full device compromise including credential extraction or persistent backdoor installation.