CVE-2023-26801

What it actually does

This is an unauthenticated, network-accessible command injection flaw in the web management interface of affected LB-LINK router firmware. The vulnerable endpoint, /goform/set_LimitClient_cfg, fails to safely validate or escape user-controlled input in the mac, time1, and time2 parameters before passing those values to an operating-system command. A remote attacker can inject shell metacharacters into one of those parameters and cause the device to execute arbitrary commands with the privileges of the web management process, potentially resulting in full device compromise, configuration theft, traffic interception, malware installation, or denial of service. The supplied affected-product metadata references qat_engine repositories and a Git commit, which does not align with the router-firmware description; remediation should therefore be validated against the actual LB-LINK device model and firmware version in use rather than relying solely on package names in the feed.

Why it matters to the business

Compromise of an edge router can give an attacker control over network traffic, DNS settings, firewall behavior, and administrative credentials, creating risk of outages, interception, credential theft, botnet enrollment, and follow-on attacks against internal systems. The vulnerability has a critical CVSS score and a high EPSS likelihood, has been public for more than three years, and has exploit code available, so internet-exposed devices should be treated as high-priority remediation targets even though it is not currently listed in CISA KEV and is not specifically flagged for ransomware use.

How an attack unfolds

An attacker first identifies an exposed LB-LINK router management interface by scanning for reachable web administration services and fingerprinting the device or firmware family. The attacker then sends a crafted HTTP request to /goform/set_LimitClient_cfg with malicious shell syntax embedded in the mac, time1, or time2 parameter. If the firmware is vulnerable, the web interface passes the parameter into a system command without proper sanitization, causing the injected command to run on the router. After initial command execution, the attacker may retrieve configuration files, dump credentials, alter DNS or routing settings, disable security controls, install a persistence mechanism, join the device to a botnet, or use the router as a pivot point for additional reconnaissance against connected networks.

How to fix it

Upgrade affected LB-LINK router firmware to a vendor-provided fixed release for the specific model, or replace unsupported devices if no fixed firmware is available. At minimum, affected versions include LB-LINK BL-AC1900_2.0 v1.0.1, BL-WR9000 v2.4.9, BL-X26 v1.2.5, and BL-LTE300 v1.0.8. If the environment inventory also contains 01org/qat_engine or intel/qat_engine entries associated with this CVE feed, verify them separately because the listed fixed commit 1c95fd724e0b92f9e9b210db64d7cc19469f1977 appears inconsistent with the router vulnerability description. Until firmware is updated, restrict router administration interfaces to trusted management networks only, disable WAN-side administration, enforce strong administrator credentials, block unauthenticated access to /goform/set_LimitClient_cfg where possible, and monitor for unexpected outbound traffic from router management IPs. After patching, rotate router administrative credentials and review DNS, NAT, port-forwarding, VPN, and firewall settings for unauthorized changes.

How to confirm the fix worked

Confirm the exact device model and firmware version through the router administration interface, device inventory, SNMP, configuration backup, or physical asset records. Verify that no affected firmware versions remain deployed and that WAN-side management is disabled or restricted by access control lists. Test exposure by confirming that /goform/set_LimitClient_cfg is not reachable from untrusted networks and that requests containing shell metacharacters in mac, time1, or time2 are rejected, sanitized, or logged without command execution. Validate the fix by checking vendor firmware release notes or checksums for the installed image, reviewing configuration integrity, and confirming there are no unexpected processes, cron jobs, startup scripts, DNS settings, port forwards, or outbound connections from the router.

Typical attack path

1. Scan the internet or local network for exposed LB-LINK router web management interfaces.
2. Fingerprint the device model and firmware version to identify BL-AC1900_2.0 v1.0.1, BL-WR9000 v2.4.9, BL-X26 v1.2.5, BL-LTE300 v1.0.8, or similarly vulnerable firmware.
3. Send a crafted HTTP request to /goform/set_LimitClient_cfg containing shell metacharacters in the mac, time1, or time2 parameter.
4. Confirm command execution by observing a response artifact, timing behavior, DNS callback, outbound connection, or device configuration change.
5. Run additional commands to enumerate the device, collect configuration data, retrieve credentials, or alter network settings.
6. Establish persistence, deploy malware, proxy traffic, or use the compromised router to attack adjacent systems.

How to detect it

Look for evidence of HTTP requests to /goform/set_LimitClient_cfg, especially requests containing shell metacharacters or encoded command separators in the mac, time1, or time2 parameters. Relevant log sources include router web administration logs, upstream firewall logs, reverse proxy logs if management is proxied, VPN concentrator logs for management access, NetFlow or DNS telemetry from router IPs, and configuration change logs or backups. Indicators of prior exploitation include unexpected router-initiated outbound HTTP, HTTPS, DNS, Telnet, SSH, TFTP, FTP, or IRC traffic; modified DNS resolver settings; new port-forwarding or firewall rules; unknown administrator accounts; changed remote-management settings; unfamiliar startup scripts or scheduled tasks; and unexplained reboots or web-service crashes around suspicious requests. Because many embedded devices have limited logging, absence of device logs should not be treated as proof of non-exploitation; use network telemetry and configuration-drift analysis to supplement forensic review.

• /goform/set_LimitClient_cfg
• mac=
• time1=
• time2=
• /goform/set_LimitClient_cfg?mac=
• /goform/set_LimitClient_cfg?time1=
• /goform/set_LimitClient_cfg?time2=
• %3B
• %7C
• %26%26
• %60
• %24%28
• ;wget
• ;curl
• |wget
• |curl
• `wget
• `curl
• $(wget
• $(curl
• /bin/sh
• /bin/busybox
• busybox wget
• tftp -g
• chmod +x
• /tmp/
• /var/run/
• /etc/init.d/
• /etc/rc.local

What your security team should do

• Immediately inventory LB-LINK routers and identify devices running BL-AC1900_2.0 v1.0.1, BL-WR9000 v2.4.9, BL-X26 v1.2.5, BL-LTE300 v1.0.8, or unverified firmware branches.
• Prioritize any internet-facing or remotely managed router for same-day mitigation because exploit code is available and EPSS indicates elevated exploitation likelihood.
• Disable WAN-side administration and restrict management access to a dedicated trusted network or VPN.
• Upgrade to fixed vendor firmware where available; replace devices that are end-of-life or lack a reliable security update.
• Search web, firewall, reverse proxy, and network telemetry for requests to /goform/set_LimitClient_cfg with suspicious shell metacharacters in mac, time1, or time2 parameters.
• Review router configuration for unauthorized DNS servers, port forwards, firewall rule changes, VPN users, administrator accounts, and startup commands.
• Rotate router administrative credentials after remediation and confirm no shared credentials were reused elsewhere.
• Treat unexplained outbound connections from routers as potential compromise and perform device reset/reimage if command execution is suspected.
• Validate the inconsistent qat_engine package metadata separately before using it for remediation decisions.