Ac1900 Firmware
Monthly
Command injection in LB-LINK AC1900_AZ2 router firmware V1.0.2 allows adjacent-network actors to inject OS commands through shell metacharacters passed to the bs_SetLimitCli_info function within libshare.so, triggered via a POST request to /goform/set_LimitClient_cfg. The vulnerability is notable for an internal contradiction: the CVSS vector assigns PR:H (administrative privileges required), yet the description explicitly frames the attack scenario as one where the actor lacks administrative access but can reach the endpoint - suggesting the endpoint may be accessible to lower-privilege or unauthenticated callers in certain deployments. No patch has been identified and no public exploit is confirmed at time of analysis beyond the researcher's GitHub write-up.
A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in LB-LINK AC1900_AZ2 router firmware V1.0.2 allows adjacent-network actors to inject OS commands through shell metacharacters passed to the bs_SetLimitCli_info function within libshare.so, triggered via a POST request to /goform/set_LimitClient_cfg. The vulnerability is notable for an internal contradiction: the CVSS vector assigns PR:H (administrative privileges required), yet the description explicitly frames the attack scenario as one where the actor lacks administrative access but can reach the endpoint - suggesting the endpoint may be accessible to lower-privilege or unauthenticated callers in certain deployments. No patch has been identified and no public exploit is confirmed at time of analysis beyond the researcher's GitHub write-up.
A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.