Belkin F9K1015
CVE-2025-11293
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege web access
-
DeliverySend crafted request to /goform/formConnectionSetting
-
ExploitOverflow buffer via oversized max_Conn
-
ExecutionCorrupt device memory / crash service
-
ImpactDegrade or compromise router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the specific HTTP endpoint /goform/formConnectionSetting on Belkin F9K1015 firmware 1.00.10, abusing the max_Conn argument to trigger a buffer overflow. Per the CVSS 4.0 vector, PR:L means the attacker needs low-level authenticated access to the device management interface - this is the primary limiting factor, meaning an unauthenticated internet attacker cannot exploit it directly unless credentials are weak, default, or otherwise obtained. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is further limited to this exact end-of-life firmware version with no vendor patch available. |
| Impact | Signals are mixed and point to a genuine but lower-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), but crucially requires PR:L - the attacker must already hold low-level authenticated access to the device, which meaningfully constrains unauthenticated internet-wide exploitation. Exploit maturity is E:P (proof-of-concept), consistent with the publicly available PoC on GitHub; there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. CWE-119 (improper memory buffer operations) combined with a 'buffer overflow' outcome implies potential for memory corruption and possibly code execution, but the disclosure (VulDB/VulDB-sourced) does not confirm reliable RCE versus a crash/DoS. The vendor was contacted and did not respond, so no patch exists - raising residual risk for any still-deployed units. Net: a real, publicly-exploitable flaw worth remediating on affected devices, but the PR:L requirement plus the product being a retired consumer router keeps real-world fleet risk modest rather than an emergency. No EPSS or KEV data was provided to corroborate real-world exploitation volume - treat exploitation likelihood as unconfirmed. |
| Exploit ScenarioDerived | An attacker with low-level authenticated access to the router's web interface (e.g., a logged-in user, a weak/default credential holder, or someone on the LAN who has obtained access) sends a crafted request to /goform/formConnectionSetting with an oversized or malformed max_Conn parameter, overflowing a buffer in the handler. This can crash the device or potentially corrupt memory to influence execution. A public proof-of-concept for this exact endpoint and parameter already exists on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
A buffer overflow in the /goform/formConnectionSetting endpoint of Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to corrupt memory via the max_Conn parameter, potentially achieving code execution or causing a denial of service. The vulnerability requires low-privilege credentials to the device's web management interface (PR:L), and publicly available exploit code exists. The vendor did not respond to disclosure, no patch is available, and the device is end-of-life.
RemediationAI
No vendor-released patch has been identified for CVE-2025-11293, and Belkin did not respond to the disclosure. Because the device is end-of-life, the most effective mitigation is to replace the router with a supported model. If replacement is not possible, restrict access to the web management interface by disabling remote administration and ensuring the admin interface is only reachable from a trusted internal network; this reduces the attack surface but may limit legitimate remote management. Additionally, change default credentials and use a strong, unique password to mitigate the PR:L requirement, though this does not eliminate the vulnerability. For network-level protection, deploy a firewall or intrusion prevention system rule to block requests to /goform/formConnectionSetting with excessively long max_Conn values, but be aware that such filtering may not be feasible on all devices and could interfere with legitimate configuration changes. Monitor for unusual router behavior and consider network segmentation to isolate the device.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Belkin F9K1015 router's web management interface exposes a goform handler at /goform/formConnectionSetting, which processes the max_Conn parameter without adequate bounds checking. This is a classic CWE-119 buffer overflow, where user-supplied input is copied into a fixed-size buffer, allowing an attacker to overwrite adjacent memory. Because the handler is reachable over the network (AV:N) and requires only low-privileged authentication (PR:L), an attacker with valid credentials can trigger the overflow remotely. The affected product is identified by CPE cpe:2.3:o:belkin:f9k1015_firmware:1.00.10, indicating a firmware-specific issue in an end-of-life device.
Know when F9K1015 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint (AV:N/AC:L) but requires authenticated low-privilege web access (PR:L, not PR:N); buffer overflow yields high C/I/A on the device with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality of the file /goform/formConnectionSetting. The manipulation of the argument max_Conn leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Belkin F9K1015 routers running firmware 1.00.10 are impacted by a high-severity buffer overflow (CVE-2025-11293) that allows authenticated attackers with low-privilege credentials to corrupt memory, potentially leading to code execution or denial of service. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, as the device is end-of-life. Organizations using these routers in their networks face a heightened risk of compromise, which could enable lateral movement or service disruption, making it critical for leadership to prioritize risk mitigation or replacement.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management interface access to trusted networks, enforcing strong unique credentials, disabling remote administration, segmenting affected devices, monitoring for exploitation attempts, and planning for device replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in F9K1015 Firmware
View allA buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) can be triggered by sending an over-long pinCode value
Buffer overflow in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers with low-privilege web-interfac
A buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) lets a low-privilege, authenticated remote attacker co
A buffer overflow in the Belkin F9K1015 router running firmware 1.00.10 is reachable through the HTTP management handler
A buffer overflow in the Belkin F9K1015 router firmware version 1.00.10 lets an attacker who already holds a valid sessi
Authenticated remote attackers can overflow a memory buffer in the Belkin F9K1015 router (firmware 1.00.10) by submittin
Buffer overflow in the Belkin F9K1015 wireless router (firmware 1.00.10) allows an attacker who can reach the device's w
Buffer overflow in Belkin F9K1015 router firmware 1.00.10 allows a remote, low-privilege authenticated attacker to overw
Stack-based buffer overflow in Belkin F9K1015 wireless router firmware 1.00.10 enables authenticated remote attackers to
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Exploit-DB