EUVD-2026-12369Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface
-
ExploitSend crafted request to /goform/get_hidessid_cfg
-
ExecutionTrigger buffer overflow in sub_44D844
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | LB-LINK BL-WR9000 firmware version 2.4.9 with web management interface enabled. Requires valid login credentials to access /goform/get_hidessid_cfg endpoint. |
| Impact | This vulnerability presents a significant real-world risk based on multiple factors. The CVSS score of 8.8 indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L), meaning any authenticated user can exploit it remotely without user interaction. The existence of a public proof-of-concept exploit (E:P) dramatically increases the likelihood of exploitation. While not currently listed in CISA's KEV catalog, the combination of public exploit availability, unresponsive vendor, and the widespread use of router devices in both home and small business environments creates a critical exposure window. The technical impact is severe (C:H/I:H/A:H), allowing complete device takeover, and the attack is likely automatable given the low complexity and network vector. |
| Exploit ScenarioDerived | An attacker with low-level authenticated access to the router's web interface can send a specially crafted request to the /goform/get_hidessid_cfg endpoint containing oversized input data that triggers the buffer overflow in function sub_44D844. This allows the attacker to overwrite memory and potentially execute arbitrary code with router privileges, leading to complete device compromise. A working proof-of-concept is publicly available at https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_HideSSID%20stack%20overflow_EN.md, making exploitation straightforward for even moderately skilled attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Remote code execution in LB-LINK BL-WR9000 2.4.9 via buffer overflow in the /goform/get_hidessid_cfg endpoint allows authenticated attackers to achieve complete system compromise over the network. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An attacker with login credentials can trigger the overflow in the sub_44D844 function to execute arbitrary code with full system privileges.
Earlier versions of this analysis (1)
A buffer overflow vulnerability exists in the LB-LINK BL-WR9000 router firmware version 2.4.9, specifically in the /goform/get_hidessid_cfg endpoint's sub_44D844 function. This vulnerability allows authenticated remote attackers to potentially execute arbitrary code, leading to full system compromise with high impacts to confidentiality, integrity, and availability. A proof-of-concept exploit has been publicly disclosed and the vendor has not responded to security reports, leaving devices unpatched and exposed.
RemediationAI
As the vendor has not responded to security reports and no patch is available, immediate mitigation steps are critical. Replace affected LB-LINK BL-WR9000 devices with alternative router models from responsive vendors, or isolate these devices from internet exposure by placing them behind a properly configured firewall. If replacement is not immediately possible, disable remote management features, restrict access to the administrative interface to trusted IP addresses only, and monitor for suspicious activity targeting the /goform/get_hidessid_cfg endpoint. Consider contacting LB-LINK support directly for firmware updates, though their unresponsiveness to security reports suggests limited support availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the LB-LINK BL-WR9000 wireless router (CPE: cpe:2.3:a:lb-link:bl-wr9000:*:*:*:*:*:*:*:*), specifically version 2.4.9. The issue is a classic buffer overflow (CWE-120) occurring in the sub_44D844 function when processing requests to the /goform/get_hidessid_cfg endpoint, which appears to handle SSID hiding configuration. Buffer overflows occur when data written to a buffer exceeds its allocated bounds, potentially overwriting adjacent memory and allowing attackers to inject and execute malicious code. The vulnerable endpoint likely handles wireless network configuration without proper input validation or boundary checking.
Know when Bl Wr9000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical buffer overflow vulnerability in LB-LINK BL-WR9000 routers (firmware 2.4.9) enables authenticated attackers to execute arbitrary code and gain complete system control. Organizations using this router model face immediate risk of network compromise, data breach, and operational disruption, with no vendor patch available and active public exploits in circulation.
Implement network access controls restricting connections to affected routers; deploy WAF/IPS rules to monitor and block requests to /goform/get_hidessid_cfg endpoint; segment affected routers from critical infrastructure and sensitive systems; enforce strong authentication and multi-factor authentication for administrative access; disable web management interface if not actively required and use out-of-band management instead; monitor for suspicious authentication attempts and unauthorized configuration changes; consider isolating the device to a separate management VLAN with restricted egress.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB