CVE-2026-35869

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.

• CWE-20

• https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC450M/bs_SetLimitCli_info.md

Published

Aug 27, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3582An Incorrect Authorization vulnerability was identified in G…4.3
• CVE-2026-3584The Kali Forms plugin for WordPress is vulnerable to Remote …9.8
• CVE-2026-35847An issue in dnsmgr v.2.15 and before allows a local attacker…9.8
• CVE-2026-3585The The Events Calendar plugin for WordPress is vulnerable t…7.5
• CVE-2026-35867A Command Injection vulnerability exists in the bs_SetLimitC…3.1
• CVE-2026-35868A Command Injection vulnerability exists in the bs_SetLimitC…9.8
• CVE-2026-3587An unauthenticated remote attacker can exploit a hidden func…10
• CVE-2026-3588A server-side request forgery (SSRF) vulnerability in IKEA D…5.5
• CVE-2026-3589The WooCommerce WordPress plugin from versions 5.4.0 to 10.5…7.5
• CVE-2026-3590Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 1…6.5
• CVE-2026-35901A handling issue in the RTSP service of the Mercury MIPC252W…4.4
• CVE-2026-35902The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 2…6.2