Quick answers
- Is CVE-2026-35867 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35867 being exploited in the wild.
- How severe is CVE-2026-35867?
- Low severity, with a CVSS score of 3.1, published 13 September 2026.
- Which products and versions are affected?
- LB-Link AC1900 AZ2 V1.0.2.
- Is there a fix for CVE-2026-35867?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-35867 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-35867?
- Check whether you run LB-Link AC1900 AZ2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a command injection flaw in the bs_SetLimitCli_info function within libshare.so, a core library of the LB-LINK AC1900_AZ2 router running firmware version V1.0.2. The vulnerable endpoint is "POST /goform/set_LimitClient_cfg", which fails to properly sanitize shell metacharacters in user-supplied input before passing it to system command execution. An unauthenticated network-adjacent attacker can exploit this by crafting a malicious POST request with shell command injection payloads to achieve remote code execution. No administrative credentials are required for exploitation, and patches availability is not mentioned.
Affected products
- LB-LINK AC1900_AZ2 V1.0.2
Timeline
- 2026-09-13: disclosed