External risk intelligence

LB-link Router AC450M Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-35869

The vulnerability affects a consumer router, a device typically deployed as an internet-facing gateway. Command injection vulnerabilities in router management or configuration interfaces are commonly reachable if the administration interface is exposed to the WAN or through common deployment patterns where such devices act as the perimeter edge.

Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in a router's shared library, allowing unauthenticated remote attackers to execute arbitrary commands on the device. This type of flaw, if exploited, could potentially compromise the security and integrity of network devices.

Attackers can run unauthorized commands remotely.
It affects internet-facing network devices.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input over the network to the vulnerable function in the router's `libshare.so` library. Because the input is not properly checked, these crafted commands can be executed as if they were legitimate system commands, potentially allowing the attacker to take control of the router.

No authentication or user interaction required.
User-supplied input triggers command execution.
Arbitrary code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the `bs_SetLimitCli_info` function could allow an unauthenticated attacker to execute arbitrary operating system commands on affected devices. This could occur when specially crafted input is provided to the vulnerable parameter, bypassing intended input validation and sanitization.

System commands could be executed.
Unauthenticated network access.
Compromise of device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the LB-link Router AC450M likely impacts network and security teams responsible for edge devices and vendor management. The first practical step is to identify all instances of this router, assess their reachability and business criticality, and then coordinate with the vendor for remediation.

Network/Security and Vendor Management teams.
Confirm router reachability and business criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the LB-link Router AC450M?

The LB-link Router AC450M is a consumer-grade network device designed to manage internet connectivity and local network traffic. The vulnerability specifically resides within its libshare.so library, a component responsible for shared system functions. In home and small office setups, this hardware typically serves as the primary gateway between the local network and the internet, processing configuration and management tasks.

What does Command Injection mean for CVE-2026-35869?

This vulnerability, classified as Improper Input Validation (CWE-20), occurs when the router fails to clean or check data provided by a user. Because the software does not properly filter this input before passing it to the operating system, an attacker can insert shell commands. This essentially tricks the router into running unauthorized instructions, giving the attacker the ability to execute commands with the system's own privileges.

How is this command injection vulnerability triggered?

An attacker triggers the flaw by sending specially crafted input to the bs_SetLimitCli_info function. The vulnerability is triggered purely through network interaction; it does not require an attacker to have a password or interact with a user. Conversely, sending standard, non-malicious configuration data or interacting with non-vulnerable functions on the router will not activate this specific security weakness.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this device as likely vulnerable because consumer routers often function as internet-facing gateways. If your router's management or configuration interface is accessible over the internet, it is at higher risk of reachability. Even if the interface is not directly exposed, common deployment patterns where these devices act as the perimeter edge make them high-priority assets to investigate.

What are the first steps to handle this vulnerability?

Start by locating every LB-link Router AC450M currently active in your network environment. Once identified, evaluate whether these devices are reachable from the public internet and determine their overall business importance. After assessing your footprint, reach out to the vendor for official guidance or firmware updates to remediate the vulnerability, as these steps ensure you are prepared for a coordinated fix.

References

github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC45…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.