A critical stack-based buffer overflow vulnerability in LB-LINK BL-WR9000 routers allows remote attackers to cause a denial of service via the /goform/get_hidessid_cfg endpoint.

The vulnerability exists in the bs_GetSSIDHide function, which fails to perform bounds checking when using sscanf to process the HideSSID configuration value. An authenticated attacker can trigger a stack overflow by injecting an overly long string into the nvram configuration, subsequently calling the affected route to crash the web service.

Successful exploitation of this vulnerability results in an immediate denial of service for the device web interface. Because the affected component is critical for router management, this can lead to significant operational downtime, preventing administrators from reconfiguring network settings or monitoring device status. Given the CVSS score of 8.8, this flaw represents a high risk to network availability.

Immediate Action: There is currently no vendor-provided patch for this vulnerability. Administrators should restrict management interface access to trusted IP addresses only and disable remote management features where possible.

Proactive Monitoring: Monitor system logs for repeated crashes of the /bin/goahead process or unusual activity originating from the /goform/get_hidessid_cfg endpoint.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface, specifically filtering requests to the /goform/ directory.

Public Exploit Available: Yes, a proof-of-concept demonstrating the overflow and crash mechanism is available via the researcher's GitHub write-up.

Due to the lack of a vendor patch, this vulnerability poses a persistent risk to LB-LINK BL-WR9000 deployments. Organizations must immediately isolate these devices from public-facing networks and restrict administrative access to authorized management segments to prevent unauthorized exploitation of the memory corruption flaw.