CVE-2026-35867: LB-LINK AC1900_AZ2 Router RCE Vulnerability

CVE-2026-35867 Overview

CVE-2026-35867 is a command injection vulnerability affecting the LB-LINK AC1900_AZ2 router running firmware V1.0.2. The flaw resides in the bs_SetLimitCli_info function within the libshare.so library. An attacker on an adjacent network can inject shell metacharacters through a crafted POST /goform/set_LimitClient_cfg request. Exploitation requires high privileges and a specific deployment scenario where the actor can reach the endpoint without holding administrative access. Successful exploitation permits execution of arbitrary shell commands on the device with limited integrity and availability impact. The vulnerability is classified under [CWE-78] (OS Command Injection).

Critical Impact
An adjacent network attacker meeting the preconditions can inject shell commands into the router firmware through an unauthenticated-adjacent web endpoint, enabling arbitrary command execution within the device operating environment.

Affected Products

LB-LINK AC1900_AZ2 router
Firmware version V1.0.2
libshare.so library containing the bs_SetLimitCli_info function

Discovery Timeline

2026-09-13 - CVE-2026-35867 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-35867

Vulnerability Analysis

The vulnerability exists in the bs_SetLimitCli_info function exported by the libshare.so shared library on the LB-LINK AC1900_AZ2 router. The function processes parameters submitted through the router's web management interface via the POST /goform/set_LimitClient_cfg endpoint. User-controlled input is passed to a shell interpreter without adequate sanitization or escaping of shell metacharacters such as ;, |, &, and backticks. This design allows an attacker to append additional shell commands to legitimate parameter values. The command execution occurs within the context of the process handling the router's configuration interface. The vulnerability requires adjacent network access, meaning the attacker must be on the same physical or logical network segment such as the local wireless LAN.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. The bs_SetLimitCli_info function constructs a shell command string using attacker-controlled fields from the set_LimitClient_cfg form submission and executes it through a shell interpreter. Without input validation or safe argument passing, shell metacharacters embedded in the parameters are interpreted rather than treated as literal data.

Attack Vector

Exploitation requires the attacker to reach the router's HTTP management interface on an adjacent network segment. The attacker crafts a POST /goform/set_LimitClient_cfg request containing shell metacharacters within the client-limit configuration fields. The vulnerability description notes exploitation applies to deployment scenarios where the actor can issue this request without already holding administrative credentials. See the GitHub Vulnerability Documentation for the technical proof of concept.

No verified exploit code is available. Refer to the linked technical
reference for parameter-level details of the crafted POST request.

Detection Methods for CVE-2026-35867

Indicators of Compromise

HTTP POST requests to /goform/set_LimitClient_cfg containing shell metacharacters such as ;, |, &, $(), or backticks in body parameters.
Unexpected child processes spawned by the router's HTTP daemon or configuration handler.
Configuration entries for the client limit feature containing non-standard characters or truncated values suggesting injected payloads.

Detection Strategies

Inspect router access logs and any upstream network telemetry for POST requests targeting the set_LimitClient_cfg form with anomalous payloads.
Deploy network intrusion detection signatures that flag shell metacharacter patterns within HTTP request bodies destined for LB-LINK management interfaces.
Baseline outbound connections from the router; alert on new connections to unfamiliar destinations that may indicate post-exploitation activity.

Monitoring Recommendations

Forward router syslog and management interface access logs to a centralized SIEM for correlation with network telemetry.
Monitor DHCP and ARP tables for unauthorized clients on network segments that can reach the router's management interface.
Track firmware version and configuration checksums to detect unauthorized modifications following suspected exploitation.

How to Mitigate CVE-2026-35867

Immediate Actions Required

Restrict access to the router's HTTP management interface to trusted management VLANs or specific administrator hosts.
Disable remote management features and any WAN-side access to /goform endpoints.
Change default credentials and enforce strong authentication on all router accounts.
Segment untrusted clients such as guest wireless networks away from the management interface.

Patch Information

No vendor patch has been referenced in the published CVE data. Consult LB-LINK vendor advisories for firmware updates addressing the bs_SetLimitCli_info function in libshare.so. Until a fix is available, apply the compensating controls listed below.

Workarounds

Place the router behind a network segment that isolates it from untrusted adjacent clients.
Filter inbound HTTP requests to the router's management interface using an upstream firewall or access control list.
Consider replacing affected devices with hardware that receives active security maintenance if a firmware update is not forthcoming.

bash

# Example: restrict management interface access via upstream firewall
# Only allow the admin workstation to reach the router web UI
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 \
  -s <admin_workstation_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP