B-Link set_hidessid_cfg enable Parameter Command Injection Attempt

Tim Peck@timpeck

•updated Nov 10, 2025•0•19

This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.