This vulnerability is a stack-based buffer overflow in the BL-WR9000’s /goform/get_virtual_cfg endpoint, located in the sub_44E8D0 function. An attacker can exploit the overflow by sending crafted input, potentially leading to arbitrary code execution on the device. The weakness is characterized by the CWE identifiers for buffer overflow and memory corruption, indicating a serious integrity compromise of the device’s firmware. The impact is that an unauthenticated remote attacker can gain control of the router, potentially enabling further network attacks or a pivot to internal assets.

The affected product is the LB-LINK BL-WR9000 router running firmware version 2.4.9. No other versions are listed, so the scope is limited to this particular firmware build. Administrators should verify whether their deployed units match this version or a vulnerable variant.

The CVSS score of 8.7 classifies this issue as high severity, and the EPSS score of less than 1% suggests low current exploitation activity. The vulnerability is not yet catalogued in CISA’s KEV list. The attack vector is remote, as the description states, and can be carried out by sending malicious requests to the vulnerable endpoint. Successful exploitation would allow attackers to inject code, modify firmware, or otherwise compromise device integrity.