EUVD-2025-20138Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/wan_gateway/wl_ssid is directly passed by the attacker/so we can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in Belkin F9K1122 firmware version 1.00.33 allows remote authenticated attackers to execute arbitrary commands on the device. The vulnerability resides in the formBSSetSitesurvey function of the web server, accessible at /goform/formBSSetSitesurvey, where parameters like wan_ipaddr, wan_gateway, and wl_ssid are passed unsanitized to a system command. Public proof-of-concept exploit code is available, but the vendor has not responded to disclosure and no patch is available; though the CVSS 4.0 base score is Low (2.1), the EPSS probability of exploitation is moderate at 1.08% (78th percentile).
More in F9k1122 Firmware
View allA vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the fu
A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. Affected by this vulnerability is
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. This vulnerability affects the func
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. Affected is the function formWl
A vulnerability, which was classified as critical, has been found in Belkin F9K1122 1.00.33. Affected by this issue is t
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. This issue affects the function formWanT
A vulnerability, which was classified as critical, was found in Belkin F9K1122 1.00.33. This affects the function formPP
A vulnerability classified as critical was found in Belkin F9K1122 1.00.33. Affected by this vulnerability is the functi
A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33. Affected is the function formPPTPSetup
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. This issue affects the function form
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. Affected by this issue is the functi
Remote command injection in Belkin F9K1122 firmware version 1.00.33 allows authenticated low-privilege attackers to exec
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today