Belkin F9K1015 CVE-2025-11296

Exploitation requires reaching the router's web management endpoint /goform/formPPTPSetup and submitting an overlong pptpUserName parameter; the provided CVSS vector's PR:L indicates authenticated access to the management interface is needed, which is the primary limiting factor. Practical risk rises when the admin interface is exposed to untrusted networks (WAN-side or a shared LAN) and when default or weak credentials are in use, which is common on consumer routers. No user interaction is required (UI:N). There is no vendor patch because Belkin did not respond to disclosure, so affected 1.00.10 devices remain exposed; mitigation depends on restricting management-interface access and credential hygiene.

Signals are moderately consistent and point to a real but bounded risk. The VulDB-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 7.4) describes a network-reachable, low-complexity buffer overflow that requires some privilege level (PR:L) and yields full confidentiality/integrity/availability impact on the device. Publicly available exploit code exists (GitHub PoC by panda666-888), and the embedded CVSS carries E:P (proof-of-concept), which corroborates PoC maturity but is NOT evidence of active exploitation. This CVE is NOT in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be asserted. The PR:L metric indicates authenticated access is needed, which materially limits drive-by mass exploitation and suggests the realistic threat is an attacker who already has a low-privilege foothold or valid credentials (common on consumer routers left at default or weak credentials). Net: a genuine code-execution flaw with a working PoC on an end-of-life consumer router, but the authentication requirement and absence of KEV/EPSS signals place it below the tier of an unauthenticated, actively-exploited network zero-day. Note a vendor-coordination gap: Belkin was contacted but did not respond, so no official patch or advisory is expected.

An attacker with low-privilege access to the router's web management interface (e.g., via default/weak credentials or an existing foothold on the LAN) sends a crafted request to /goform/formPPTPSetup with an overlong pptpUserName value. A public proof-of-concept exists, so the overflow can be triggered reliably to crash the service or execute attacker-controlled code on the device. Because PR:L is required, the attacker must first be authenticated to the management interface.