CVE-2026-35867 LB-LINK CVE debrief

Who should care

Defenders responsible for LB-LINK AC1900_AZ2 V1.0.2 devices, especially those exposed to the internet or untrusted networks, should assess their exposure and prioritize patching or compensating controls.

Why it matters

CVE-2026-35867 is a Command Injection vulnerability in LB-LINK AC1900_AZ2 V1.0.2 routers. Defenders should verify exposure, prioritize patching, and monitor affected devices.

• Verify patch deployment for affected devices
• Restrict access to vulnerable endpoints
• Monitor for suspicious activity

Technical summary

The bs_SetLimitCli_info function in the libshare.so library of LB-LINK AC1900_AZ2 V1.0.2 is vulnerable to Command Injection attacks via shell metacharacters when an actor can make a 'POST /goform/set_LimitClient_cfg' call without administrative access. This vulnerability is particularly concerning because it allows attackers to execute arbitrary commands on the device, potentially leading to a complete compromise of the system. The vulnerability is exacerbated by the fact that the device is widely used and exposed to the internet or untrusted networks. To mitigate this vulnerability, defenders should prioritize patching or compensating controls for affected devices.

Defensive priority

Verify and prioritize patching for LB-LINK AC1900_AZ2 V1.0.2 devices exposed to the internet or untrusted networks, especially if the 'POST /goform/set_LimitClient_cfg' endpoint is accessible.

Recommended defensive actions

• Verify and prioritize patching for LB-LINK AC1900_AZ2 V1.0.2 devices exposed to the internet or untrusted networks
• Restrict access to the 'POST /goform/set_LimitClient_cfg' endpoint
• Monitor for suspicious activity on affected devices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library in LB-LINK AC1900_AZ2 V1.0.2. The vulnerability requires the actor to make a 'POST /goform/set_LimitClient_cfg' call without administrative access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.