Belkin F9K1015
CVE-2025-11299
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege/admin session
-
ExploitSend crafted formWanTcpipSetup request
-
ExecutionOverflow pppUserName buffer
-
ImpactCorrupt memory / execute code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the router's HTTP administration interface and an authenticated session (CVSS PR:L), after which a single crafted request to the /goform/formWanTcpipSetup endpoint with an oversized pppUserName parameter triggers the overflow. Limiting factors: the attacker must be able to reach the admin web service (typically LAN-side or an exposed management port) and must hold valid credentials or exploit default ones, since this is not an unauthenticated flaw; it is specific to Belkin F9K1015 firmware 1.00.10. No special non-default feature toggle is described - the vulnerable WAN TCP/IP setup handler is a standard part of the management interface. |
| Impact | This is a genuine but moderately-scoped risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity flaw requiring low privileges (PR:L = an authenticated session on the router's web interface) with high impact to confidentiality, integrity and availability, scoring 7.4. The exploit maturity is marked E:P (proof-of-concept), consistent with the publicly available POC on GitHub - publicly available exploit code exists, but this is NOT confirmed active exploitation. No CISA KEV listing is present in the input and no EPSS score was supplied, so widespread automated exploitation cannot be asserted; absence of these signals should not be read as either high or low probability. The chief caveat is the PR:L requirement: 'remote' here means network-reachable but still presupposes a valid admin/authenticated session (or default credentials), which materially limits opportunistic mass exploitation. CWE-119 (memory-buffer overflow) in a router's WAN setup handler plausibly yields remote code execution on the device, but the advisory describes only 'buffer overflow' without confirming RCE versus crash/DoS - this should be verified against the POC. The vendor was contacted and did not respond, so no official patch is expected. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (via valid or default credentials on a reachable network) sends a crafted POST to /goform/formWanTcpipSetup with an overlong pppUserName value, overflowing a fixed-size buffer in the request handler. A publicly available POC exists, lowering the barrier to reproduction; successful exploitation can crash the device or potentially execute attacker-controlled code on the router. Because PR:L applies, the attacker must first reach and authenticate to the admin interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
A buffer overflow in the Belkin F9K1015 router firmware version 1.00.10 lets an attacker who already holds a valid session on the device's web administration interface crash or potentially execute code on the device by sending a single crafted request with an oversized pppUserName parameter to the /goform/formWanTcpipSetup endpoint. The flaw is not unauthenticated - the CVSS v4.0 vector (PR:L) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both require the attacker to reach the management service and authenticate first, which in practice means LAN-side access or an exposed administrative port plus valid or default credentials. Publicly available exploit code exists for this specific issue, raising the likelihood of opportunistic attacks against internet-exposed or poorly segmented units, and the vendor was contacted but did not respond, leaving users dependent on compensating controls.
RemediationAI
No vendor-released patch has been identified at time of analysis, and Belkin did not respond to the disclosure, so users should not expect a fixed firmware version and must rely on compensating controls. The highest-value mitigation is to eliminate exposure of the administrative interface: disable remote/WAN management, place the router behind a NAT/firewall that blocks inbound access to its web UI from untrusted networks, and restrict management access to a trusted LAN segment or a dedicated management VLAN - the trade-off is loss of convenient remote administration. Change the default administrator credentials and enforce a strong unique password, since the flaw requires an authenticated session (PR:L) and default or weak credentials materially lower the bar; note this only raises the effort for an attacker who cannot otherwise obtain a session. Where remote management is mandatory, front the interface with a VPN or an authenticating reverse proxy and apply source-IP allow-listing so only trusted hosts can reach /goform/formWanTcpipSetup; this adds operational overhead and a single point of failure. Because the vendor is unresponsive, the most durable option for affected units is replacement with a router that receives security updates. Monitor the VulDB entry (https://vuldb.com/?id.327180) for any later vendor advisory or firmware release; the publicly available exploit code referenced above should be treated as a prompt to verify that no affected device is reachable from untrusted networks.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the HTTP management handler /goform/formWanTcpipSetup in Belkin F9K1015 firmware 1.00.10, the standard firmware image identified by CPE cpe:2.3:o:belkin:f9k1015_firmware:1.00.10. This class of embedded router web interface typically routes form submissions through a CGI-style handler that copies user-supplied form fields into fixed-size stack or heap buffers before parsing them; the pppUserName field used for WAN PPPoE credentials is passed into that copy routine without adequate length validation. The root cause maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), i.e., a classic memory-safety violation in which attacker-controlled input exceeds the destination buffer and overwrites adjacent memory, corrupting control data and typically producing a crash and, under the right conditions, control-flow hijacking. Because the vulnerable handler is part of the standard WAN TCP/IP configuration flow rather than an optional feature, no non-default toggle needs to be enabled, though exploitation still requires an authenticated session against the management interface.
Know when F9K1015 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin endpoint (AV:N/AC:L), but a valid authenticated session to the web UI is required (PR:L); memory-corruption plausibly yields full device compromise (C:H/I:H/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Belkin F9K1015 1.00.10. The affected element is an unknown function of the file /goform/formWanTcpipSetup. The manipulation of the argument pppUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Belkin F9K1015 routers running firmware 1.00.10 are affected by an authenticated buffer overflow in the web administration interface that can crash the device or potentially enable code execution. Because publicly available exploit code exists and no vendor-released patch has been identified, organizations with these devices exposed to untrusted networks or using default credentials face elevated risk of service disruption and network compromise. Leadership should prioritize identifying affected units and reducing management-plane exposure while planning replacement or isolation.
No vendor-released patch identified at time of analysis; interim mitigations include disabling remote management, changing default credentials, restricting admin access to trusted networks, segmenting affected devices, monitoring for exploit attempts, and replacing unsupported routers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in F9K1015 Firmware
View allA buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) can be triggered by sending an over-long pinCode value
Buffer overflow in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers with low-privilege web-interfac
A buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) lets a low-privilege, authenticated remote attacker co
A buffer overflow in the Belkin F9K1015 router running firmware 1.00.10 is reachable through the HTTP management handler
Authenticated remote attackers can overflow a memory buffer in the Belkin F9K1015 router (firmware 1.00.10) by submittin
Buffer overflow in the Belkin F9K1015 wireless router (firmware 1.00.10) allows an attacker who can reach the device's w
Buffer overflow in Belkin F9K1015 router firmware 1.00.10 allows a remote, low-privilege authenticated attacker to overw
A buffer overflow in the /goform/formConnectionSetting endpoint of Belkin F9K1015 firmware 1.00.10 allows authenticated
Stack-based buffer overflow in Belkin F9K1015 wireless router firmware 1.00.10 enables authenticated remote attackers to
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Exploit-DB