What is GHSA-cw3c-9w3h-vf4q?

GHSA-cw3c-9w3h-vf4q is a security advisory published by GitHub Security Advisories with Low severity. A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare...

Which CVE IDs does GHSA-cw3c-9w3h-vf4q cover?

GHSA-cw3c-9w3h-vf4q covers the following CVE IDs: CVE-2026-35867. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cw3c-9w3h-vf4q?

GHSA-cw3c-9w3h-vf4q has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

GHSA-cw3c-9w3h-vf4qLowCVSS 3.1

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-35867 →

📋 Description

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-35867
https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC1900_AZ2/bs_SetLimitCli_info.md
https://github.com/advisories/GHSA-cw3c-9w3h-vf4q