Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-35867

Command Injection Vulnerability in LB‑Link AC1900 Firmware via /goform/set_LimitClient_cfg Endpoint

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.

CVSS 3.1 · 3.1 Low EPSS 1.0% KEV · Not listed
Vendors
Lb-link
Products
Ac1900 Firmware
CVE-2025-1610

LB-LINK AC1900 Router set_blacklist websGetVar os command injection

A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 13.2% KEV · Not listed
Vendors
Lb-link
Products
Ac1900 Ac1900 Firmware
CVE-2025-1609

LB-LINK AC1900 Router set_cmd websGetVar os command injection

A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 10.2% KEV · Not listed
Vendors
Lb-link
Products
Ac1900 Ac1900 Firmware
CVE-2025-1608

LB-LINK AC1900 Router set_manpwd websGetVar os command injection

A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd  leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 10.2% KEV · Not listed
Vendors
Lb-link
Products
Ac1900 Ac1900 Firmware