# CVE-2026-35868: LB-Link AC2100_AZ3 command injection in libshare.so

Source: https://junglewise.ai/threats/cve-2026-35868-lb-link-ac2100-az3-command-injection-in-libshare-so  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35868 · Severity: critical · CVSS 9.8 · Published 2026-08-27

The LB-Link AC2100_AZ3 is a wireless router used to provide network connectivity in homes and small businesses. A flaw in the router's web interface allows an attacker to inject arbitrary shell commands by manipulating network parameters, leading to complete takeover of the device and potential compromise of all connected network traffic.

Vendors: [LB-Link](https://junglewise.ai/threats/vendors/lb-link).

## Quick answers

**Is CVE-2026-35868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35868 being exploited in the wild.

**How severe is CVE-2026-35868?** Critical severity, with a CVSS score of 9.8, published 27 August 2026.

**Which products and versions are affected?** LB-Link AC2100 AZ3 V1.0.4.

**Is there a fix for CVE-2026-35868?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35868 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-35868?** Check whether you run LB-Link AC2100 AZ3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the bs_SetLimitCli_info function within libshare.so, where user-supplied MAC address parameters are unsafely concatenated into OS-level commands without proper sanitization or validation. The vulnerable code path begins in the goahead web server, which extracts user-controllable parameters (mac, time1, time2) via websGetVar and passes them to bs_SetLimitCli_info, which then directly concatenates the mac parameter into a system command via the bl_do_system function. An unauthenticated network attacker can inject shell metacharacters (pipes, command separators, backticks) into the mac parameter to achieve arbitrary command execution with router privileges. The vulnerability is network-reachable and requires no authentication or user interaction. A patch or firmware update from LB-Link has not been confirmed as available.

## Affected products

- LB-Link AC2100_AZ3 V1.0.4

## Timeline

- 2026-08-27: disclosed: CVE-2026-35868 published on NVD

## References

- [https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC2100_AZ3/bs_SetLimitCli_info.md](https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC2100_AZ3/bs_SetLimitCli_info.md)