Description
A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Buffer Overflow
Action: Restrict Access
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow in the sub_44D844 function of the /goform/get_hidessid_cfg page on the LB‑LINK BL‑WR9000 router. Sending a specially crafted request that overflows the buffer can corrupt memory, potentially allowing an attacker to execute arbitrary code or crash the web interface. The weakness is classified as CWE‑119, CWE‑120, and CWE‑125.

Affected Systems

The affected product is the LB‑LINK BL‑WR9000 router, firmware version 2.4.9. Only this firmware revision is listed in the CVE data, and no other versions or related products are indicated.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score is below 1 %, suggesting limited evidence of widespread exploitation. The description explicitly states that the attack can be initiated remotely, implying that an external attacker could target an exposed router via its web interface. No official fix has been reported by the vendor in the supplied data, increasing the risk for devices that remain accessible.

Generated by OpenCVE AI on March 20, 2026 at 21:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether LB‑LINK has released a firmware update that corrects the buffer overflow and apply the update if available.
  • If no update is found, limit external access to the router’s web administration interface, for example by placing the device on an internal network segment or by configuring an access‑control list.
  • Continuously monitor HTTP requests to the /goform/get_hidessid_cfg endpoint for suspicious activity and alert on repeated attempts.

Generated by OpenCVE AI on March 20, 2026 at 21:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Lb-link bl-wr9000 Firmware
Weaknesses CWE-125
CPEs cpe:2.3:h:lb-link:bl-wr9000:-:*:*:*:*:*:*:*
cpe:2.3:o:lb-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*
Vendors & Products Lb-link bl-wr9000 Firmware

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Lb-link
Lb-link bl-wr9000
Vendors & Products Lb-link
Lb-link bl-wr9000

Mon, 16 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 08:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Lb-link Bl-wr9000 Bl-wr9000 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T16:48:52.842Z

Reserved: 2026-03-15T18:41:15.204Z

Link: CVE-2026-4227

cve-icon Vulnrichment

Updated: 2026-03-16T16:48:44.536Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-16T14:20:15.770

Modified: 2026-03-20T18:20:28.800

Link: CVE-2026-4227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-24T10:45:24Z

Weaknesses