A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. (CVE-2026-35869)

The LB-link Router AC450M V4.0.0 contains a command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library. The vulnerability is due to improper sanitization of user-supplied input, which is directly used in system command execution contexts. This allows an attacker to inject shell metacharacters or payloads, resulting in arbitrary operating system command execution on the device.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary operating system commands on the affected router, potentially leading to full compromise of the device, unauthorized access, or disruption of network services. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the vulnerable device and avoid exposing management interfaces to untrusted networks.