What is the CVSS score of CVE-2026-4227?

CVE-2026-4227 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bl Wr9000 are affected by CVE-2026-4227?

A critical buffer overflow vulnerability in LB-LINK BL-WR9000 routers (firmware 2.4.9) enables authenticated attackers to execute arbitrary code and gain complete system control.

Is there a public PoC exploit available for CVE-2026-4227?

Yes, a public proof-of-concept exploit is available for CVE-2026-4227. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4227?

Within 24 hours: Identify and inventory all LB-LINK BL-WR9000 devices running firmware 2.4.9 in production and test environments; restrict administrative access to these devices to essential personnel only. Within 7 days: Implement network segmentation to isolate affected routers from critical systems; disable the /goform/get_hidessid_cfg endpoint if possible through firmware configuration; deploy WAF rules to block malicious requests to this endpoint. Within 30 days: Replace affected router units with alternative vendors that provide active security support and patch management, or contact LB-LINK for firmware updates; conduct forensic analysis of affected devices for signs of compromise.

Bl Wr9000 CVE-2026-4227

EUVD-2026-12369 HIGH

Classic Buffer Overflow (CWE-120)

2026-03-16 VulDB

Buffer Overflow Bl Wr9000 Lb Link

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 20, 2026 - 18:20 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 09:00 euvd

EUVD-2026-12369

Analysis Generated

Mar 16, 2026 - 09:00 vuln.today

CVE Published

Mar 16, 2026 - 08:02 nvd

HIGH 8.8

DescriptionCVE.org

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code execution in LB-LINK BL-WR9000 2.4.9 via buffer overflow in the /goform/get_hidessid_cfg endpoint allows authenticated attackers to achieve complete system compromise over the network. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An attacker with login credentials can trigger the overflow in the sub_44D844 function to execute arbitrary code with full system privileges.

Technical ContextAI

The vulnerability affects the LB-LINK BL-WR9000 wireless router (CPE: cpe:2.3:a:lb-link:bl-wr9000:*:*:*:*:*:*:*:*), specifically version 2.4.9. The issue is a classic buffer overflow (CWE-120) occurring in the sub_44D844 function when processing requests to the /goform/get_hidessid_cfg endpoint, which appears to handle SSID hiding configuration. Buffer overflows occur when data written to a buffer exceeds its allocated bounds, potentially overwriting adjacent memory and allowing attackers to inject and execute malicious code. The vulnerable endpoint likely handles wireless network configuration without proper input validation or boundary checking.

RemediationAI

As the vendor has not responded to security reports and no patch is available, immediate mitigation steps are critical. Replace affected LB-LINK BL-WR9000 devices with alternative router models from responsive vendors, or isolate these devices from internet exposure by placing them behind a properly configured firewall. If replacement is not immediately possible, disable remote management features, restrict access to the administrative interface to trusted IP addresses only, and monitor for suspicious activity targeting the /goform/get_hidessid_cfg endpoint. Consider contacting LB-LINK support directly for firmware updates, though their unresponsiveness to security reports suggests limited support availability.