Belkin F9K1015 CVE-2025-11294

Requires network access to the router's HTTP management interface and, per the CVSS vector (PR:L), low-privilege authenticated access to that interface; the attacker then submits a crafted request to the /goform/formL2TPSetup endpoint with an oversized L2TPUserName argument to trigger the buffer overflow. Limiting factors: the vulnerable endpoint is part of the device's web administration console (typically not internet-exposed by default, so exploitation usually requires LAN position or an exposed WAN management interface), valid credentials are needed unless the interface is unauthenticated in a given deployment, and the affected product is a specific, discontinued firmware version (F9K1015 1.00.10) for which no vendor patch exists.

This is a stack/memory buffer overflow (CWE-119) in the L2TPUserName parameter of /goform/formL2TPSetup on Belkin F9K1015 firmware 1.00.10. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) indicates a network-reachable, low-complexity attack that nonetheless requires some level of privilege (PR:L) and yields high impact to confidentiality, integrity, and availability of the device itself (no scope change to subsequent systems). Exploit maturity is Proof-of-Concept (E:P), which aligns with the single public PoC reference on GitHub - publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active, widespread exploitation. The most important mitigating signal, which raises real-world risk above a typical PoC, is that this is an end-of-life consumer router from a vendor that did not respond to coordinated disclosure, so no patch is expected. Conversely, the strongest limiting signals are the device's narrow, retired deployment footprint and the PR:L requirement (authenticated access to the web UI). Net assessment: a genuine but targeted/opportunistic risk against exposed or internally-reachable legacy Belkin routers, not a mass-exploitation emergency. Note a conflict worth verifying: the description says 'attack may be launched remotely' and mentions no authentication, yet the CVSS vector encodes PR:L - treat the auth requirement per the vector, but confirm whether the management interface requires credentials in the target deployment.

An attacker with network reachability to the router's web management interface and low-privilege credentials sends a crafted POST to /goform/formL2TPSetup containing an overly long L2TPUserName value, overflowing a fixed-size buffer. This can crash the device (denial of service) or, if the overflow is controllable, achieve code execution on the router. A public proof-of-concept for this exact endpoint and parameter is available on GitHub.