CVE-2023-26801

CVE-2023-26801 is a critical command injection vulnerability affecting several LB-LINK router models, including the BL-AC1900_2.0, BL-WR9000, BL-X26, and BL-LTE300. The flaw allows unauthenticated attackers to execute arbitrary commands by manipulating the mac, time1, and time2 parameters within the /goform/set_LimitClient_cfg endpoint. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges, and can lead to complete compromise of confidentiality, integrity, and availability. Its high EPSS score and FAUCET Risk Score of 98/100 indicate a significant likelihood of exploitation. While not listed in CISA's KEV catalog, this vulnerability has garnered substantial community discussion and media coverage, with reports indicating its active exploitation by botnets like Mirai, RondoDox, and Aquabotv3 targeting industrial routers. Although no public exploit code is explicitly mentioned for this specific CVE, the widespread botnet activity suggests readily available exploitation methods.