CVE-2026-4228 is a command injection flaw in the Wi-Fi settings handler of the LB-LINK BL-WR9000 router, firmware 2.4.9, scored CVSS 6.3 (medium). The vendor did not respond to the disclosure, so no fix is confirmed. Restrict the web interface and limit who can log in.
What's affected
The NVD record names LB-LINK BL-WR9000 firmware 2.4.9. The affected code is the function sub_458754 behind the /goform/set_wifi route.
No fixed version exists in the record, which says the vendor was contacted early and did not reply. The reporter's write-up used firmware 2.4.9 dated 2023-06-20.
How to check if you're exposed
- Read the firmware version in the router's administration page. Version 2.4.9 is the tested build.
- Check whether the web interface is reachable from the internet. Run this from outside your network, against your own address only.
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
- Review the accounts that can log in. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which needs a low privileged login. The write-up calls it an authenticated command injection.
What to do now
- Disable remote administration and any port forward to the router.
- Change the administrator password and remove unused logins.
- Look for newer firmware from LB-LINK. If none exists, schedule a replacement.
- Put untrusted devices on a separate Wi-Fi network.
Why it matters
The record classes this as CWE-74 and CWE-77. According to the write-up, the Wi-Fi settings code builds a system command by joining configuration values into a string without checking them, and then runs that command. Anyone who can change those settings can influence what the router executes.
The write-up describes the result as commands running with the highest privileges on the device. The KEV flag is false. The record says the exploit is public, and I found no report of exploitation in the wild.
Quick check
Does this need a login?
The NVD vector says a low privileged account is needed, and the write-up calls it authenticated. Treat router logins as sensitive and change default passwords.
Sources
Last reviewed: 19 October 2026.
