60
CVE-2023-26801
PoC —CVSS 3.1
9.8 critical
EPSS
70%p99
Published
()
Modified
Description
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.
- Vendors
- lb-link
- Products
- bl-lte300 firmware, bl-x26 firmware, bl-wr9000 firmware, bl-ac1900 firmware
- Weakness
- CWE-77
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news5 stories
60
60
Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks
60
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.
40