EUVD-2025-20142Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Remote command injection in Belkin F9K1122 firmware version 1.00.33 allows authenticated low-privilege attackers to execute arbitrary OS commands via the /goform/mp endpoint. The vulnerability is publicly disclosed with a proof-of-concept exploit available, but no vendor patch exists. Despite a critical classification, the low-impact CVSS 4.0 vector and moderate EPSS score (1.08%, 78th percentile) indicate limited immediate risk—priority is warranted only if the device is internet-exposed and using weak credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when F9k1122 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in F9k1122 Firmware
View allA vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the fu
A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. Affected by this vulnerability is
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. This vulnerability affects the func
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. Affected is the function formWl
A vulnerability, which was classified as critical, has been found in Belkin F9K1122 1.00.33. Affected by this issue is t
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. This issue affects the function formWanT
A vulnerability, which was classified as critical, was found in Belkin F9K1122 1.00.33. This affects the function formPP
A vulnerability classified as critical was found in Belkin F9K1122 1.00.33. Affected by this vulnerability is the functi
A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33. Affected is the function formPPTPSetup
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. This issue affects the function form
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. Affected by this issue is the functi
OS command injection in Belkin F9K1122 firmware version 1.00.33 allows remote authenticated attackers to execute arbitra
Exploit-DB