CVE-2023-26801

critical

Description

LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.

References

Exploits
More

https://thehackernews.com/2025/01/new-aquabot-botnet-exploits-cve-2024.html

https://www.bleepingcomputer.com/news/security/new-aquabotv3-botnet-malware-targets-mitel-command-injection-flaw/

https://www.akamai.com/blog/security-research/2025-january-new-aquabot-mirai-variant-exploiting-mitel-phones

https://thehackernews.com/2025/01/mirai-botnet-variant-exploits-four.html

https://www.bleepingcomputer.com/news/security/new-mirai-botnet-targets-industrial-routers-with-zero-day-exploits/

https://blog.xlab.qianxin.com/gayfemboy/

https://blog.xlab.qianxin.com/catddos-derivative-en/

https://www.akamai.com/blog/security-research/cve-2023-26801-exploited-spreading-mirai-botnet

https://github.com/winmt/my-vuls/tree/main/LB-LINK%20BL-AC1900%2C%20BL-WR9000%2C%20BL-X26%20and%20BL-LTE300%20Wireless%20Routers

Details

Source: Mitre, NVD

Published: 2023-03-26

Updated: 2025-05-05

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H