CVE-2026-4228 - Vulnerability Details

- LB-LINK BL-WR9000 set_wifi sub_458754 command injection

Description

A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-03-16

Score: 5.3 Medium

EPSS: 8.9% Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the sub_458754 function of the /goform/set_wifi handler. An attacker can supply crafted input that is not properly sanitized, leading to arbitrary command injection on the device, as evidenced by public exploits. The issue falls under CWE‑74 and CWE‑77.

Affected Systems

The flaw impacts LB‑LINK BL‑WR9000 routers with firmware version 2.4.9. Based on the description, the likely attack vector is remote interaction with the router’s web interface, which would allow execution of commands on the device’s operating system.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of 9% indicates a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers with remote access to the web interface could exploit, and the actual threat depends on how exposed the device is and the protections applied by the administrator.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LB-LINK

BL-WR9000

affected

Version	Status	Constraints
`2.4.9`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:lb-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*

cpe:2.3:h:lb-link:bl-wr9000:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Lb-link

Bl-wr9000

100%

Version	Status	Scheme	Platform
`2.4.9`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check for and deploy any updated LB‑LINK BL‑WR9000 firmware that addresses the command injection issue.
If a firmware update is unavailable, block external access to the router’s web interface using firewall rules or ACLs so that only the local network can reach it.
Disable remote administration features for Wi‑Fi configuration via the web interface if the router’s settings provide that option.
Ensure the device uses a strong, unique administrator password and enable password protection on the web interface.
Consider placing the router on a separate VLAN or network segment to reduce its exposure to potential attackers.

Generated by OpenCVE AI on September 26, 2026 at 09:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.08894.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_wlanpswencry%20command%20injection_EN.md
https://vuldb.com/?ctiid.351151
https://vuldb.com/?id.351151
https://vuldb.com/?submit.771210

History

Fri, 20 Mar 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lb-link bl-wr9000 Firmware
CPEs		cpe:2.3:h:lb-link:bl-wr9000:-:::::::* cpe:2.3:o:lb-link:bl-wr9000_firmware:2.4.9:::::::*
Vendors & Products		Lb-link bl-wr9000 Firmware

Tue, 17 Mar 2026 10:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lb-link Lb-link bl-wr9000
Vendors & Products		Lb-link Lb-link bl-wr9000

Mon, 16 Mar 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 16 Mar 2026 08:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		LB-LINK BL-WR9000 set_wifi sub_458754 command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_wlanpswencry%20command%20injection_EN.md https://vuldb.com/?ctiid.351151 https://vuldb.com/?id.351151 https://vuldb.com/?submit.771210
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Lb-link Bl-wr9000 Bl-wr9000 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-16T08:02:10.790Z

Updated: 2026-03-16T16:41:59.288Z

Reserved: 2026-03-15T18:41:17.685Z

Link: CVE-2026-4228

Vulnrichment

Updated: 2026-03-16T16:41:51.519Z

NVD

Status : Analyzed

Published: 2026-03-16T14:20:16.030

Modified: 2026-06-17T10:56:15.933

Link: CVE-2026-4228

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T10:00:16Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object