CVE-2026-35869: n/a

This vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. Due to inadequate validation and sanitization of user-supplied input before passing it to a system command execution context, an attacker can inject shell metacharacters or payloads to execute arbitrary operating system commands. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected router without authentication, potentially leading to full system compromise, data theft, service disruption, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interfaces and monitor for suspicious activity related to command injection attempts.