LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

CVE-2026-35869

CVE-2026-35869 is a command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library on the LB-link Router AC450M V4.0.0 . The root cause is insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution contex...

CVE-2026-35868

A Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-link Router AC2100_AZ3 V1.0.4 . The root cause is insufficient validation and sanitization of user-supplied input before it reaches a system-level command execution context. An attacker...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19971

CVE-2026-19971 affects LB-Link WR1210M firmware 1.0.3. The flaw resides in the Backup Endpoint component, specifically the /www/cgi-bin/backup.cgi main function, allowing missing authentication within the local network. In practical terms, an attacker on the same LAN could access or tamper with b...

EUVD-2026-60022

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19971 LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-19901

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability ...

CVE-2026-19900

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

EUVD-2026-59777

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability ...

CVE-2026-19901 LB-LINK X-PRO easycwmp hard-coded credentials

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability ...

CVE-2026-19901

CVE-2026-19901 affects LB-LINK X-PRO 1.0.22-20231206. The vulnerability targets the file /etc/config/easycwmp, enabling manipulation that results in hard-coded credentials. It can be launched remotely and is described as high-severity with components affected including confidentiality, integrity,...

EUVD-2026-59776

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

CVE-2026-19900

CVE-2026-19900 affects LB-LINK X-PRO 1.0.22-20231206. The vulnerability is in an unknown function of the /etc/shadow file, leading to hard-coded credentials. Exploitation can be initiated remotely, with high attack complexity and a HIGH impact on confidentiality, integrity, and availability. Expl...

CVE-2026-19900 LB-LINK X-PRO shadow hard-coded credentials

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

PT-2026-73040

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The...

PT-2026-73041

Name of the Vulnerable Software and Affected Versions LB-LINK X-PRO version 1.0.22-20231206 Description A security flaw exists in the /etc/config/easycwmp file that allows for the use of hard-coded credentials. This issue can be exploited remotely, although the attack is considered highly complex...

CVE-2026-4228

A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub458754 of the file /goform/setwifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about th...

CVE-2026-4227

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub44D844 of the file /goform/gethidessidcfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be...