EUVD-2026-12367Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to LB-LINK BL-WR9000
-
ExploitSend crafted request to /goform/get_virtual_cfg
-
ExecutionTrigger stack buffer overflow in sub_44E8D0
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | LB-LINK BL-WR9000 firmware version 2.4.9 with /goform/get_virtual_cfg endpoint accessible. Valid authentication credentials required. Attacker must have network access to device's web interface on default ports. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), enabling full compromise of confidentiality, integrity, and availability. The presence of a public proof-of-concept exploit (E:P) dramatically increases real-world risk. While not currently listed in CISA's KEV catalog, the combination of a publicly available exploit, ease of exploitation (low complexity), and the fact that only low privileges are required makes this a high-priority vulnerability for organizations using affected devices. The vendor's lack of response to disclosure attempts further elevates risk as no patch appears forthcoming. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to the router's web interface sends a specially crafted request to the /goform/get_virtual_cfg endpoint containing an oversized payload that overflows the stack buffer in function sub_44E8D0. This allows the attacker to overwrite the return address and execute arbitrary code with the privileges of the web server process, potentially gaining full control of the router. A detailed proof-of-concept demonstrating this attack is publicly available at https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_VirtualRules%20stack%20overflow_EN.md. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Stack Overflow's infrastructure contains a stack-based buffer overflow in a virtual configuration function that can be exploited remotely by authenticated attackers to achieve complete system compromise. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. An attacker with valid credentials can manipulate input to the vulnerable endpoint and execute arbitrary code with full system privileges.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the LB-LINK BL-WR9000 router firmware version 2.4.9, specifically in the function sub_44E8D0 within the /goform/get_virtual_cfg endpoint. This vulnerability allows authenticated remote attackers to potentially execute arbitrary code, leading to complete compromise of the device. A public proof-of-concept exploit is available on GitHub, significantly increasing the risk of active exploitation in the wild.
RemediationAI
No patch is currently available as the vendor has not responded to disclosure attempts. Organizations should immediately implement compensating controls including restricting network access to the router's management interface to trusted IP addresses only, disabling the vulnerable /goform/get_virtual_cfg endpoint if possible, and considering replacement with alternative router models from responsive vendors. Monitor the VulDB advisory at https://vuldb.com/?id.351149 for any future updates. Given the lack of vendor support, replacing affected devices should be strongly considered as a long-term solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the LB-LINK BL-WR9000 router (CPE: cpe:2.3:a:lb-link:bl-wr9000:*:*:*:*:*:*:*:*), specifically version 2.4.9 as confirmed by EUVD-2026-12367. The root cause is a classic stack-based buffer overflow (CWE-121) where the application fails to properly validate input size before copying data to a fixed-size buffer on the stack. This occurs in the sub_44E8D0 function when processing requests to the /goform/get_virtual_cfg endpoint, likely related to virtual configuration management functionality in the router's web interface.
Know when Bl Wr9000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical remote code execution vulnerability affecting LB-LINK BL-WR9000 routers (firmware 2.4.9) poses an immediate threat to organizations deploying these devices. With a public exploit available and no vendor patch released, any organization using this router model faces significant risk of network compromise and unauthorized access to internal systems.
Implement Web Application Firewall (WAF) rules to block requests to /goform/get_virtual_cfg endpoint; disable authenticated remote access to the vulnerable endpoint via access control lists; restrict administrative access to router management interfaces to whitelisted IP addresses only; segment router networks to limit lateral movement if compromise occurs; increase monitoring and alerting for suspicious authentication attempts and code execution patterns; consider implementing network-level controls to prevent communication from router to internal systems; evaluate router replacement with alternative vendors as primary mitigation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB