H0Lyduck

**Name of the Vulnerable Software and Affected Versions** LB-LINK AC1900 Router version 1.0.2 **Description** The issue concerns an os command injection vulnerability. It is related to the `/goform/set cmd` endpoint and the `websGetVar` variable. **Recommendations** For LB-LINK AC1900 Router version 1.0.2, consider restricting access to the `/goform/set cmd` endpoint to minimize the risk of exploitation. Avoid using the `websGetVar` variable in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LB-LINK AC1900 Router version 1.0.2 **Description** The issue concerns an os command injection vulnerability, specifically affecting the `/goform/set blacklist` endpoint, where the `mac` and `enable` variables are involved. **Recommendations** For LB-LINK AC1900 Router version 1.0.2, avoid using the `/goform/set blacklist` endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LB-LINK AC1900 Router version 1.0.2 **Description** A critical issue was found in the function `websGetVar` of the file `/goform/set manpwd`. The manipulation of the argument `routepwd` leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public. **Recommendations** For LB-LINK AC1900 Router version 1.0.2, as a temporary workaround, consider restricting access to the `/goform/set manpwd` endpoint to minimize the risk of exploitation. Avoid using the argument `routepwd` in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.