CVE-2026-4228
Published: 16 March 2026
Summary
CVE-2026-4228 is a medium-severity Injection (CWE-74) vulnerability in Lb-Link Bl-Wr9000 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4228 is a command injection vulnerability (CWE-74, CWE-77) in the LB-LINK BL-WR9000 router firmware version 2.4.9. The flaw affects the sub_458754 function in the /goform/set_wifi file, where manipulated input leads to arbitrary command execution. Published on 2026-03-16, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by low-privileged users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables attackers to achieve limited impacts on confidentiality, integrity, and availability, such as executing unauthorized commands within the router's context.
Advisories note that the exploit is publicly available and may be used, with detailed proof-of-concept on GitHub and entries on VulDB (ctiid.351151, id.351151, submit.771210). The vendor was contacted early for disclosure but provided no response or patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12371
Vulnerability details
A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.…
more
The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router web interface (/goform/set_wifi) enables exploitation of public-facing application (T1190) and arbitrary command execution via Network Device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by validating and sanitizing manipulated inputs to the sub_458754 function in /goform/set_wifi.
Requires timely identification, reporting, and remediation of the known command injection flaw in the router firmware.
Enforces access control policies to restrict low-privileged users from remotely accessing the vulnerable /goform/set_wifi endpoint.