CVE-2023-26801

Think of this like a side door on your router that anyone on the internet can open without a key. Once inside, an attacker can run their own commands on the device, effectively owning it the way a thief would own your house if they had a master key — they can spy on your network traffic, cut your internet, or use the router to attack other systems.

This matters if your business uses an LB-LINK BL-AC1900, BL-WR9000, BL-X26, or BL-LTE300 router for internet or network connectivity. It is a risk primarily if the router's web management interface is reachable from the internet, but even on an internal network a compromised device gives an attacker a foothold.

This is a critical, actively weaponizable flaw: a public exploit tool already exists, it requires no login or user action, and security researchers rate it as very likely to be targeted by attackers. There is no vendor firmware fix yet, so any exposed device should be isolated from the internet now rather than waiting for a patch.

Confirm exposure by identifying the exact firmware version on each affected model (BL-AC1900_2.0 v1.0.1, BL-WR9000 v2.4.9, BL-X26 v1.2.5, BL-LTE300 v1.0.8) and checking whether the web management interface (specifically the /goform/set_LimitClient_cfg endpoint) is reachable from the WAN side. There is currently no vendor-supplied patched firmware version for this CVE; the vendor's only published remediation is compensating controls — deploy firewall rules to block external access to the admin/web interface and use an IDS/IPS to detect/block command-injection patterns targeting the mac, time1, and time2 parameters. A working public PoC exists on GitHub, so treat exposed devices as imminently exploitable. Monitor vendor firmware release pages for a fix and apply it as soon as available; in the interim, disable remote management, restrict admin access to trusted LAN IPs only, and consider network segmentation to limit blast radius if the device is compromised.

CVSS 3.1 score 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. Weakness class is CWE-77 (OS command injection) via unsanitized mac/time1/time2 parameters passed to the set_LimitClient_cfg form handler. No CISA KEV listing and no confirmed in-the-wild exploitation reported in press as of now, but a public PoC exploit exists on GitHub and EPSS scores it at 69.7% (99th percentile) with a rising trend, indicating very high predicted exploitation likelihood. Sustained press attention is noted but attributed to the vulnerability's severity/exploitability rather than confirmed incidents. No firmware fix is published; vendor guidance is limited to network-layer compensating controls (firewalling, IDS/IPS).