LB-LINK AC1900 Router Command Injection Vulnerability in Version 1.0.2

A critical command injection vulnerability has been identified in the LB-LINK AC1900 Router running firmware version 1.0.2. The issue arises in the '/goform/set_blacklist' endpoint, specifically within the 'websGetVar' function. The vulnerability allows remote attackers to inject operating system commands by manipulating the 'mac' and 'enable' arguments. This flaw could potentially lead to arbitrary code execution on the device.

Impact

Exploitation of this vulnerability allows for command injection, which could be used to execute arbitrary commands on the router's operating system. This type of vulnerability is often exploited to gain unauthorized access or control over the device.