Critical · published March 26, 2023
CVSS calls it critical at 9.8. It sits in the 99.4th percentile for exploit probability.
🚨 Yikes! A command injection vulnerability in LB-LINK routers lets attackers execute arbitrary commands just by sending a crafty request. 🔥 Think of it like a restaurant that lets a diner make their own menu changes without checking with the chef—opening the door for anyone to order whatever they want, even things that could ruin the meal! An attacker could exploit this vulnerability to execute commands with the same privileges as the router's system, leading to unauthorized access and control of the network. This could result in data breaches, device manipulation, or even turning the router into a launchpad for further attacks. Absolutely devastating!
Think of it like a restaurant that lets a diner make their own menu changes without checking with the chef—opening the door for anyone to order whatever they want, even things that could ruin the meal! This command injection vulnerability exists in the /goform/set_LimitClient_cfg endpoint, where parameters like mac, time1, and time2 are not properly sanitized, allowing attackers to inject and execute arbitrary commands on the device.
An attacker could exploit this vulnerability to execute commands with the same privileges as the router's system, leading to unauthorized access and control of the network. This could result in data breaches, device manipulation, or even turning the router into a launchpad for further attacks. Absolutely devastating! Update your router firmware immediately to versions v1.0.2 for BL-AC1900, v2.4.10 for BL-WR9000, v1.2.6 for BL-X26, and v1.0.9 for BL-LTE300. Additionally, review and restrict access to the management interface to trusted devices only, and consider disabling remote management. 🛡️ You've got this! With the right updates in place, you’ll lock down your devices and keep your network safe. 😊💪