Belkin F9K1015 CVE-2025-11302

Exploitation requires the attacker to reach the router's HTTP management interface and submit a request to the /goform/formWpsStart endpoint with an over-long pinCode parameter that overflows a fixed-size buffer - the specific trigger is the WPS PIN start handler. The supplied CVSS 4.0 vector sets PR:L, so a low-privilege/authenticated session (or an endpoint reachable after minimal access) is indicated, and UI:N means no victim interaction is needed. Limiting factors: exploitation is bounded by whether the web interface is exposed (typically LAN-side by default rather than WAN, unless remote management is enabled), the stated privilege requirement, and the fact that only firmware version 1.00.10 of the F9K1015 is confirmed affected. No official patch is available because the vendor did not respond.

Signals are moderately consistent and point to a real but not top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact on the vulnerable system yields a score of 7.4, indicating remote, low-complexity exploitation that nonetheless requires some level of privilege (PR:L). Exploitation status is 'publicly available exploit code exists' (POC on GitHub) with the CVSS 4.0 exploit maturity set to E:P (Proof-of-Concept) - this is NOT confirmed active exploitation, and the CVE is NOT on the CISA KEV list. EPSS is low at 1.08% (64th percentile), which is consistent with a public POC existing but no evidence of mass automated exploitation, suggesting any real-world use would be opportunistic or targeted against exposed devices rather than widespread. The key tension: CVSS marks this authenticated (PR:L) and network-reachable, yet consumer router /goform/ WPS endpoints historically vary in whether they enforce authentication - the actual privilege requirement should be verified against the device, as PR:N would materially raise urgency. The vendor was contacted and did not respond, so no official patch exists, which increases residual risk for any deployed units. Overall: a legitimate remote code execution/DoS risk on an affected device, but tempered by low EPSS, no KEV listing, a niche/legacy product, and a privilege prerequisite.

A remote attacker with network reachability to the router's web management interface sends a crafted request to /goform/formWpsStart with an oversized pinCode argument, overflowing a fixed-size buffer. A public proof-of-concept exists (panda666-888 GitHub), lowering the barrier to reproduce; successful exploitation can crash the device or, if the overflow is controllable, execute arbitrary code on the router. Per the CVSS 4.0 vector the attack is low-complexity (AC:L) but requires some privilege level (PR:L).