Cyber Posture

CVE-2026-4228

MediumPublic PoC

Published: 16 March 2026

Published
16 March 2026
Modified
20 March 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0048 65.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.…

more

The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by validating and sanitizing manipulated inputs to the sub_458754 function in /goform/set_wifi.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and remediation of the known command injection flaw in the router firmware.

AC-3 Access Enforcement partial match
prevent

Enforces access control policies to restrict low-privileged users from remotely accessing the vulnerable /goform/set_wifi endpoint.

Security SummaryAI

CVE-2026-4228 is a command injection vulnerability (CWE-74, CWE-77) in the LB-LINK BL-WR9000 router firmware version 2.4.9. The flaw affects the sub_458754 function in the /goform/set_wifi file, where manipulated input leads to arbitrary command execution. Published on 2026-03-16, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables attackers to achieve limited impacts on confidentiality, integrity, and availability, such as executing unauthorized commands within the router's context.

Advisories note that the exploit is publicly available and may be used, with detailed proof-of-concept on GitHub and entries on VulDB (ctiid.351151, id.351151, submit.771210). The vendor was contacted early for disclosure but provided no response or patches.

Details

CWE(s)
CWE-74CWE-77

Affected Products

lb-link
bl-wr9000 firmware
2.4.9

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection in router web interface (/goform/set_wifi) enables exploitation of public-facing application (T1190) and arbitrary command execution via Network Device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References