CVE-2026-4228
Remote Command Injection in LB-LINK BL-WR9000 Wi-Fi Setup
Publication date: 2026-03-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lb-link | bl-wr9000_firmware | 2.4.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-4228 is a command injection vulnerability found in the LB-LINK BL-WR9000 router, version 2.4.9. It exists in the function sub_458754 within the /goform/set_wifi endpoint, which handles WiFi configuration settings.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the router's software does not properly validate or sanitize user-supplied input parameters such as wlanpswencry and AuthMode. These parameters are directly concatenated into system command strings that are executed with root privileges."}, {'type': 'paragraph', 'content': 'As a result, an attacker with authenticated access can inject arbitrary shell commands remotely, leading to execution of commands with the highest system privileges on the device.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely execute arbitrary system commands on the affected router with root privileges.
The impact includes potential full compromise of the device, leading to loss of confidentiality, integrity, and availability of the router.
An attacker could use this access to manipulate network traffic, install malware, disrupt network services, or pivot to other devices on the network.
Since the exploit is publicly available and easy to execute, the risk of exploitation is high.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the LB-LINK BL-WR9000 router is running firmware version 2.4.9 and if the /goform/set_wifi endpoint is accessible. Since the vulnerability involves command injection via parameters such as wlanpswencry and AuthMode, monitoring or testing these parameters for injection attempts can help detect exploitation.'}, {'type': 'paragraph', 'content': 'A practical detection method is to attempt to send crafted POST requests to the /goform/set_wifi endpoint with specially crafted wlanpswencry or AuthMode parameters containing harmless command injection payloads to see if the device executes them. For example, sending a payload that tries to create a benign file or directory can indicate vulnerability.'}, {'type': 'paragraph', 'content': 'Example command using curl to test for command injection (requires authenticated access):'}, {'type': 'list_item', 'content': 'curl -X POST -d "wlanpswencry=WPAPSKWPA2PSK$(touch /tmp/vuln_test)" http://[router_ip]/goform/set_wifi -b cookies.txt'}, {'type': 'paragraph', 'content': 'After running the above, check if the file /tmp/vuln_test exists on the router (if accessible) or monitor for unexpected behavior indicating command execution.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the router's administrative interface to trusted networks and users only, as the vulnerability requires authenticated access to the /goform/set_wifi endpoint."}, {'type': 'paragraph', 'content': 'Since no vendor patch or official fix is available due to lack of vendor response, it is recommended to replace the affected device with a different model or vendor that does not have this vulnerability.'}, {'type': 'paragraph', 'content': 'Additionally, monitor network traffic for suspicious POST requests to /goform/set_wifi and disable remote management features if enabled to reduce exposure.'}, {'type': 'paragraph', 'content': "If possible, implement network-level controls such as firewall rules to block unauthorized access to the router's management interface."}] [3, 2]