Cyber Posture

CVE-2026-4227

HighPublic PoC

Published: 16 March 2026

Published
16 March 2026
Modified
20 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed…

more

publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates inputs to the vulnerable /goform/get_hidessid_cfg endpoint, preventing buffer overflow exploitation in sub_44D844.

SI-16 Memory Protection good match
prevent

Implements memory protections such as stack canaries, ASLR, and DEP to mitigate buffer overflow vulnerabilities like CWE-119 in the affected function.

SI-2 Flaw Remediation partial match
preventdetect

Requires monitoring for publicly disclosed flaws like CVE-2026-4227 and remediating via patching, isolation, or replacement since no vendor fix is available.

Security SummaryAI

CVE-2026-4227 is a buffer overflow vulnerability affecting the LB-LINK BL-WR9000 router running firmware version 2.4.9. The issue resides in the function sub_44D844 within the file /goform/get_hidessid_cfg, which handles Hide SSID configuration requests. This flaw, associated with CWE-119, CWE-120, and CWE-125, allows improper memory operations that can be triggered remotely. The vulnerability was published on 2026-03-16 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Attackers with network access and low privileges, such as authenticated users on the device, can exploit this vulnerability remotely without user interaction. By manipulating requests to the affected endpoint, adversaries can trigger the buffer overflow, potentially leading to arbitrary code execution, data corruption, or denial of service. The high confidentiality, integrity, and availability impacts suggest successful exploitation could grant full control over the device.

Advisories from VulDB and a public GitHub disclosure detail the vulnerability but note no response from the vendor despite early notification. No patches or mitigations are available from LB-LINK, leaving affected devices exposed. Security practitioners should isolate or replace vulnerable routers, monitor for anomalous traffic to the /goform/get_hidessid_cfg endpoint, and apply network segmentation.

The exploit has been publicly disclosed and may be actively used, increasing the risk for unpatched LB-LINK BL-WR9000 deployments in home or small office environments.

Details

CWE(s)
CWE-119CWE-120CWE-125

Affected Products

lb-link
bl-wr9000 firmware
2.4.9

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in the router's web management interface (/goform/get_hidessid_cfg) enables remote exploitation by authenticated low-privilege users for arbitrary code execution, directly mapping to public-facing application exploitation (T1190), remote services exploitation (T1210), and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References