LB-LINK AC1900 Router Command Injection Vulnerability

A critical command injection vulnerability has been identified in the LB-LINK AC1900 Router running firmware version 1.0.2. The issue arises in the function 'websGetVar' within the file '/goform/set_manpwd', where the argument 'routepwd' can be manipulated to inject operating system commands. This vulnerability can be exploited remotely, potentially leading to arbitrary code execution on the router.

Impact

Exploitation of this vulnerability allows for operating system command injection, which could be used to execute arbitrary commands on the router's operating system. This type of vulnerability is often exploited to gain unauthorized access or control over a device.