Belkin F9K1015
CVE-2025-11297
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface with low-priv creds
-
DeliverySend crafted request to /goform/formSetLanguage
-
ExploitOverflow buffer via oversized webpage argument
-
ExecutionCorrupt stack / hijack control flow
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the web management interface of a Belkin F9K1015 router running firmware 1.00.10, plus low-privilege authentication (PR:L) to reach the /goform/formSetLanguage handler. Exploitation sends a manipulated 'webpage' parameter to trigger the overflow; no user interaction is needed. Limiting factors: the attacker must be able to reach the management interface (typically LAN-side unless the admin panel is WAN-exposed) and must hold valid low-privilege credentials. The product is discontinued and unpatched, so every deployed unit remains exposed, but the installed base is small. |
| Impact | This is a moderate, exploitation-capable but low-footprint issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-privilege authentication, scoring 7.4, with full vulnerable-system impact (VC:H/VI:H/VA:H) and E:P (proof-of-concept) exploit maturity. A public POC exists (panda666-888 GitHub writeup), and EPSS is 1.08% at the 64th percentile - elevated relative to typical obscure-router CVEs, likely reflecting the published POC, but still far from mass-exploitation territory. There is NO CISA KEV listing, so this is 'publicly available exploit code exists,' NOT confirmed active exploitation. A key caveat: the source is VulDB (cna@vuldb.com), whose buffer-overflow entries frequently assert full CIA impact (VC/VI/VA:H) when the demonstrated effect is often only a crash/DoS - code execution on this MIPS-class SOHO router is plausible but UNCONFIRMED by the available data. The real-world priority is bounded primarily by the product: the Belkin F9K1015 is a discontinued consumer router, so this is a high-severity flaw in a rare, unpatched product rather than a broad enterprise threat. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web management interface (e.g., a weak/default-credentialed LAN user, or an exposed admin panel) sends a crafted request to /goform/formSetLanguage with an oversized 'webpage' argument, overflowing a stack buffer. A public POC is available, lowering the bar; successful exploitation crashes the service and may achieve code execution on the device. Because the vendor did not respond and the product is discontinued, no patch exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
A buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) lets a low-privilege, authenticated remote attacker corrupt memory through the web management interface, specifically by manipulating the 'webpage' argument of a POST to /goform/formSetLanguage. Successful exploitation can crash the device or potentially achieve code execution with the privileges of the affected service, giving high confidentiality, integrity, and availability impact. Publicly available exploit code exists (PoC published on GitHub), but there is no CISA KEV listing; EPSS is 1.08% (64th percentile), and the vendor was contacted but never responded, so no fix has been issued for this discontinued product.
RemediationAI
No vendor-released patch has been identified for this issue: Belkin was contacted about the disclosure and did not respond, and the F9K1015 is a discontinued product, so no fixed firmware version exists. Because the /goform/formSetLanguage endpoint cannot be safely used as-is, the most reliable mitigation is to replace the device with a vendor-supported router. If the unit must remain in service, reduce exposure by ensuring the administrative web interface is never reachable from the WAN (disable remote management/port forwarding to ports 80/443 on the router), confine management access to a trusted LAN or a dedicated management VLAN, and change all default credentials so that the PR:L authentication step is harder to satisfy; note that these measures only raise the bar and do not eliminate the overflow itself. Additional compensating controls include segmenting the router's network so a compromised device cannot pivot to higher-value hosts, disabling UPnP and any unused goform services, and monitoring for abnormal HTTP POSTs to /goform/* - accepting that each of these reduces functionality (remote administration, automated port mapping) without removing the vulnerable code path. The public PoC at https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formSetLanguage.md should be treated as a working exploit template and used only for authorized testing.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the Belkin F9K1015's embedded web management firmware. The AF9K1015's goform-style HTTP interface exposes the /goform/formSetLanguage handler, which takes a user-supplied 'webpage' parameter and copies it into a fixed-size buffer without adequate length validation, allowing an overlong value to overwrite adjacent memory. The CPE cpe:2.3:o:belkin:f9k1015_firmware:1.00.10 confirms that only the 1.00.10 firmware build is known to be affected; because the underlying router platform is end-of-life and the vendor did not reply to the disclosure, the vulnerable code path is effectively unfixed across all deployed units. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates the attack is network-reachable and requires low privileges but no user interaction, which matches the practical requirement that the attacker first reach the management interface (typically LAN-side unless the admin panel is exposed to the WAN) and authenticate with valid low-privilege credentials.
Know when F9K1015 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint, low complexity, low-priv auth required (PR:L per vendor vector); full-CIA kept to match vendor claim though impact may be DoS-only in practice.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in Belkin F9K1015 1.00.10. This issue affects some unknown processing of the file /goform/formSetLanguage. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The Belkin F9K1015 router (firmware 1.00.10) contains a buffer overflow in its web management interface that can be triggered remotely, and publicly available exploit code exists. Because the product is discontinued and no vendor patch will be issued, any organization still using this device faces a persistent risk of network compromise, service disruption, or data theft. Leadership should prioritize identifying and isolating these devices, as mitigation depends entirely on compensating controls or replacement.
Restrict web management interface access to trusted networks, disable remote administration, change default credentials, monitor for exploitation attempts (e.g., unusual POST requests to /goform/formSetLanguage), segment the network, and plan for device replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in F9K1015 Firmware
View allA buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) can be triggered by sending an over-long pinCode value
Buffer overflow in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers with low-privilege web-interfac
A buffer overflow in the Belkin F9K1015 router running firmware 1.00.10 is reachable through the HTTP management handler
A buffer overflow in the Belkin F9K1015 router firmware version 1.00.10 lets an attacker who already holds a valid sessi
Authenticated remote attackers can overflow a memory buffer in the Belkin F9K1015 router (firmware 1.00.10) by submittin
Buffer overflow in the Belkin F9K1015 wireless router (firmware 1.00.10) allows an attacker who can reach the device's w
Buffer overflow in Belkin F9K1015 router firmware 1.00.10 allows a remote, low-privilege authenticated attacker to overw
A buffer overflow in the /goform/formConnectionSetting endpoint of Belkin F9K1015 firmware 1.00.10 allows authenticated
Stack-based buffer overflow in Belkin F9K1015 wireless router firmware 1.00.10 enables authenticated remote attackers to
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Exploit-DB