CVE-2026-4226 is a stack-based buffer overflow in the LB-LINK BL-WR9000 router, firmware 2.4.9, scored CVSS 8.8 (high). The record says the vendor did not respond to the disclosure, so no fix is confirmed. Keep the web interface off the internet and limit who can log in to it.
What's affected
The NVD record names LB-LINK BL-WR9000 firmware 2.4.9. The affected code is the function sub_44E8D0 behind the /goform/get_virtual_cfg route in the router's web service.
There is no fixed version. The record states the vendor was contacted early and did not reply, and the reporter's write-up lists 2.4.9, dated 2023-06-20 on the vendor download page, as the tested build. Treat any other firmware for this model as unconfirmed.
How to check if you're exposed
- Open the router's administration page and read the firmware version. If it says 2.4.9, you run the tested build.
- Check whether the administration page answers from the internet. From outside your network, scan your own public address.
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
- List who holds a login. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the attack needs a low privileged account.
What to do now
- Turn off remote administration and remove any port forward to the router's web interface.
- Change the administrator password and delete accounts you do not use.
- Check the LB-LINK download page for newer firmware. If there is none, plan to replace the router.
- Keep guest and IoT devices on a separate network from systems you care about.
Why it matters
The record classes this as CWE-119, CWE-121 and CWE-787. The write-up says a shared library behind the web service parses virtual server rules without limiting the length of the incoming data, then copies it into a small stack variable. A long malformed value can crash the web service, and the write-up says it could possibly lead to arbitrary code execution.
A router sits in front of everything else on the network, so a memory flaw in its web service deserves a quick response even when a login is needed. The KEV flag is false. The record says an exploit has been made public, and I found no report of exploitation in the wild.
Quick check
Is CVE-2026-4226 exploited in the wild?
The record's KEV flag is false and I found no advisory saying so. The record does say an exploit is public, so treat it as a known weakness.
Sources
Last reviewed: 19 October 2026.
