Belkin F9K1015 CVE-2025-11295

Exploitation requires reaching the device's HTTP management interface and submitting a request to the /goform/formPPPoESetup endpoint with an overlong pppUserName parameter; the PPPoE setup functionality must be accessible. The CVSS PR:L metric indicates an authenticated session is required, so the attacker needs valid (or default/guessable) web-admin credentials - this is the primary limiting factor, though SOHO routers frequently ship with weak defaults. No user interaction is required (UI:N). Practical exposure is bounded by whether the management interface is reachable (typically LAN-side by default; far more severe if WAN-side remote administration is enabled) and by the product's limited, likely end-of-life deployment base. Firmware version 1.00.10 of the Belkin F9K1015 is the affected target.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity buffer overflow requiring low privileges - i.e. an authenticated session - with high confidentiality, integrity, and availability impact on the device (VC:H/VI:H/VA:H), scoring 7.4. The temporal metric E:P confirms a proof-of-concept exists, matching the 'POC: Publicly available' signal and the published GitHub write-up. It is NOT listed in CISA KEV, and no EPSS probability was supplied, so there is no evidence of active or widespread exploitation - the public POC raises opportunistic risk but does not equal in-the-wild use. Two caveats temper the score: PR:L implies the attacker must already have a valid login to the router's web interface, which on SOHO devices is often the default/weak admin credential, so in practice the authentication barrier may be low; and the H/H/H impact reflects likely code execution on an embedded device but is inferred from the CWE-119 overflow class rather than confirmed by the vendor, who did not respond to disclosure. Net: a real, exploitable flaw with public POC on an unsupported consumer router, but low real-world urgency absent KEV/EPSS evidence of mass exploitation.

An attacker with access to the router's web management interface (e.g. via default or reused admin credentials, or an exposed management port) sends a crafted request to /goform/formPPPoESetup with an oversized pppUserName value, overflowing a fixed-size buffer. A public proof-of-concept is available on GitHub, lowering the effort to reproduce. Successful exploitation can crash the device or, given the CWE-119 memory-corruption class, potentially execute attacker-controlled code on the router.