Belkin F9K1015 CVE-2025-11301
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend oversized 'webpage' argument to /goform/formWlanSetupWPS
-
ExecutionTrigger buffer overflow
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reach to the device's HTTP management interface and authenticated access at a low privilege level (CVSS PR:L), then sending a crafted oversized value in the 'webpage' parameter to the /goform/formWlanSetupWPS endpoint. Limiting factors: the attacker must first obtain valid (even low-privilege) web-interface credentials and be able to reach the management interface, which is typically LAN-bound unless remote administration is enabled; exploitation is confined to the specific F9K1015 firmware version 1.00.10. No special non-default feature toggle is named in the description beyond access to the WPS/WLAN setup form itself. |
| Impact | This is a buffer overflow (CWE-119) in the Belkin F9K1015 router firmware 1.00.10, reachable over the network (CVSS 4.0 AV:N/AC:L) with low complexity but requiring low-privilege authentication (PR:L) and no user interaction. Impact is high across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), consistent with memory-corruption-driven code execution or device crash on an embedded device. Publicly available exploit code exists (GitHub PoC referenced), which raises practical risk, but there is NO CISA KEV listing and the EPSS probability is modest at 1.08% (64th percentile) - indicating no evidence of widespread active exploitation and likely only targeted or opportunistic use. The signals are broadly consistent: a genuinely network-reachable flaw with a public PoC, tempered by the PR:L authentication requirement and the limited real-world footprint of this end-of-life consumer router. Key caveat: authentication requirement is drawn from the CVSS 4.0 PR:L metric, and the CNA (VulDB) assigned the score - there is no independent vendor confirmation because Belkin did not respond to the disclosure. Net: a legitimately exploitable device flaw with public exploit code, but prioritization should be scoped to environments actually running this specific legacy hardware rather than treated as a broad enterprise emergency. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web management interface sends a crafted request to /goform/formWlanSetupWPS with an oversized 'webpage' argument, triggering a buffer overflow. A public proof-of-concept is already available, lowering the bar to reproduce the crash or potential code execution; because the interface is network-reachable, an attacker who has reached the LAN or an exposed management port could leverage this against the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Buffer overflow in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers with low-privilege web-interface access to send an oversized 'webpage' value to /goform/formWlanSetupWPS, corrupting memory and potentially achieving code execution, configuration changes, or denial of service on the router. Exploitation requires network reach to the HTTP management interface and valid low-privilege credentials (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, score 7.4; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; EPSS is 1.08% (64th percentile), indicating a modest but non-negligible likelihood.
RemediationAI
No vendor-released patch was identified at time of analysis; Belkin was contacted about the disclosure but did not respond, and the supplied references do not include a fixed firmware version. Until a patch is available, restrict the router's HTTP management interface so it is not reachable from untrusted networks: disable remote/WAN administration and place the management UI behind a trusted LAN or management VLAN/VPN. Change default credentials and remove or disable unnecessary low-privilege web accounts, because exploitation requires some valid web-interface access. If WPS is not needed, disable it, but treat that as only a partial control since it may not remove the /goform/formWlanSetupWPS parser. Monitor for crashes or unusual oversized requests to that endpoint, and if the device cannot be isolated or is unsupported, replace it. Trade-offs: disabling remote administration prevents off-site management unless VPN access is provided; LAN restriction may complicate support access; and disabling WPS removes WPS convenience.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic memory-safety flaw in the embedded HTTP management stack of the Belkin F9K1015 router. The affected product is identified by CPE cpe:2.3:o:belkin:f9k1015_firmware:1.00.10:*:*:*:*:*:*:*, meaning the issue is specific to firmware 1.00.10. The vulnerable code path handles the 'webpage' argument submitted to the /goform/formWlanSetupWPS endpoint, which is part of the WLAN/WPS setup form; an oversized value overflows a buffer. Based on the provided CVSS vector, the attacker must be remote and authenticated at low privilege (PR:L), with no user interaction, and must be able to reach the device's HTTP management interface, which is typically LAN-bound unless remote administration is enabled.
Know when F9K1015 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L) requiring authenticated low-privilege access to the management form (PR:L), yielding memory-corruption-level code execution with full C/I/A impact on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Belkin F9K1015 1.00.10. This affects an unknown function of the file /goform/formWlanSetupWPS. This manipulation of the argument webpage causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A buffer overflow vulnerability in Belkin F9K1015 routers running firmware 1.00.10 can be triggered by an authenticated, low-privilege user who can reach the HTTP management interface, potentially leading to code execution, unauthorized configuration changes, or denial of service. Because publicly available exploit code exists and no vendor patch has been identified, organizations with these devices in exposed or untrusted network segments face elevated risk. Leadership should prioritize inventorying affected routers, limiting management access, and planning hardware replacement or migration if vendor remediation does not materialize.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the HTTP management interface to trusted internal networks, disabling WAN/remote management and WPS, enforcing strong unique credentials with least privilege, segmenting routers from critical assets, monitoring for unusual /goform/formWlanSetupWPS requests, and replacing affected Belkin F9K1015 firmware 1.00.10 devices if no vendor fix becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in F9K1015 Firmware
View allA buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) can be triggered by sending an over-long pinCode value
A buffer overflow in the Belkin F9K1015 router (firmware 1.00.10) lets a low-privilege, authenticated remote attacker co
A buffer overflow in the Belkin F9K1015 router running firmware 1.00.10 is reachable through the HTTP management handler
A buffer overflow in the Belkin F9K1015 router firmware version 1.00.10 lets an attacker who already holds a valid sessi
Authenticated remote attackers can overflow a memory buffer in the Belkin F9K1015 router (firmware 1.00.10) by submittin
Buffer overflow in the Belkin F9K1015 wireless router (firmware 1.00.10) allows an attacker who can reach the device's w
Buffer overflow in Belkin F9K1015 router firmware 1.00.10 allows a remote, low-privilege authenticated attacker to overw
A buffer overflow in the /goform/formConnectionSetting endpoint of Belkin F9K1015 firmware 1.00.10 allows authenticated
Stack-based buffer overflow in Belkin F9K1015 wireless router firmware 1.00.10 enables authenticated remote attackers to
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Exploit-DB