PT-2026-25636 · Lb Link · Bl-Wr9000

Jfkk + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4226

Mitre

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub 44E8D0 of the file /goform/get virtual cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-4226

Affected Products

Bl-Wr9000

References · 9

• 🔥 https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_VirtualRules%20stack%20overflow_EN.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4226 · Security Note
• https://twitter.com/CVEnew/status/2033583688584487083 · Twitter Post
• https://twitter.com/cyberbivash/status/2033467886874841372 · Twitter Post
• https://vuldb.com/?submit.771207 · Note
• https://twitter.com/TheHackerWire/status/2033559075825607132 · Twitter Post
• https://vuldb.com/?ctiid.351149 · Note
• https://twitter.com/CveFindCom/status/2033585200668569611 · Twitter Post
• https://vuldb.com/?id.351149 · Note