Threats tagged 'ghsa-ch6g-xrcv-q4j3'

A critical vulnerability exists in LB-LINK AC1900 Router version 1.0.2 in the websGetVar function of the /goform/set_manpwd file. The flaw allows remote attackers to perform OS command injection via manipulation of the routepwd argument. Public exploit code has been disclosed. The vendor has not responded to the disclosure, and no patch information is available.