Is CVE-2026-35867 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-35867?

CVE-2026-35867 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-35867

Description

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.