EUVD-2026-16989Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in Belkin F9K1122 router (firmware 1.00.33) enables authenticated remote attackers to achieve complete system compromise via the formSetPassword endpoint. The vulnerability affects the Parameter Handler component and permits code execution with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. Vendor non-responsive to disclosure, indicating no official patch is available.
Technical ContextAI
This vulnerability manifests in the formSetPassword function within the /goform/formSetPassword endpoint of Belkin F9K1122 router firmware version 1.00.33. The root cause is a classic stack-based buffer overflow (CWE-121) in the parameter handling logic, specifically when processing the 'webpage' argument. Stack-based buffer overflows occur when input data exceeds allocated buffer space on the call stack, allowing attackers to overwrite return addresses and execute arbitrary code. In embedded devices like routers, these vulnerabilities often stem from unsafe C string functions (strcpy, sprintf) processing user-controlled input without proper bounds checking. The affected CPE (cpe:2.3:a:belkin:f9k1122:*:*:*:*:*:*:*:*) identifies this as a Belkin F9K1122 router application vulnerability, though router firmware vulnerabilities typically affect the entire device. The Parameter Handler component suggests this is part of the web management interface's input validation layer.
RemediationAI
No vendor-released patch exists for this vulnerability as Belkin did not respond to responsible disclosure attempts, and the F9K1122 product line appears to be end-of-life with no active firmware support. Primary remediation is device replacement with a currently supported router model from any vendor maintaining active security updates. Organizations unable to immediately replace affected devices should implement network-level mitigations: disable remote administration features entirely, restrict web interface access to trusted management VLANs only using firewall rules, implement strong unique administrative passwords (not defaults), and monitor for unusual administrative login attempts or router configuration changes. Consider placing affected routers behind a next-generation firewall that can inspect and filter malicious traffic to the management interface. For detailed technical analysis of the vulnerability, refer to the proof-of-concept documentation at https://github.com/Litengzheng/vul_db/blob/main/Belkin/vul_154/README.md and the VulDB entry at https://vuldb.com/vuln/353966.
Stack-based buffer overflow in Belkin F9K1122 firmware version 1.00.33 allows authenticated remote attackers to achieve
Remote code execution via stack-based buffer overflow in Belkin F9K1122 router firmware allows authenticated attackers t
Stack-based buffer overflow in Belkin F9K1122 router firmware 1.00.33 enables authenticated remote attackers to achieve
Stack-based buffer overflow in Belkin F9K1122 router version 1.00.33 allows authenticated remote attackers to achieve fu
Stack-based buffer overflow in Belkin F9K1122 router firmware 1.00.33 allows authenticated remote attackers to achieve a
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today