Skip to main content

F9K1015 CVE-2026-5611

| EUVDEUVD-2026-19152 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-04-06 VulDB GHSA-7rxh-cwgm-8354
7.4
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
PoC Detected
Apr 07, 2026 - 13:20 vuln.today
Public exploit code
EUVD ID Assigned
Apr 06, 2026 - 02:45 euvd
EUVD-2026-19152
Analysis Generated
Apr 06, 2026 - 02:45 vuln.today
CVE Published
Apr 06, 2026 - 02:00 nvd
HIGH 7.4

DescriptionCVE.org

A vulnerability was found in Belkin F9K1015 1.00.10. This affects the function formCrossBandSwitch of the file /goform/formCrossBandSwitch. Performing a manipulation of the argument webpage results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in Belkin F9K1015 wireless router firmware version 1.00.10 allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability resides in the formCrossBandSwitch function accessible via /goform/formCrossBandSwitch endpoint, where unsanitized input to the 'webpage' parameter triggers memory corruption. Publicly available exploit code exists (GitHub POC), elevating practical exploitat

Technical ContextAI

This vulnerability affects the web management interface of Belkin F9K1015 wireless routers running firmware version 1.00.10 (CPE: cpe:2.3:a:belkin:f9k1015:*:*:*:*:*:*:*:*). The flaw is a classic stack-based buffer overflow (CWE-121) in the formCrossBandSwitch CGI handler, which processes HTTP requests to /goform/formCrossBandSwitch without adequate bounds checking on the 'webpage' parameter. When oversized input is supplied, it overflows a fixed-size stack buffer, allowing an attacker to overwrite return addresses or function pointers to redirect execution flow. The formCrossBandSwitch function likely controls WiFi band steering or cross-band configuration features common in dual-band routers. Stack-based overflows in embedded web servers are particularly dangerous because ASLR and stack canaries are often absent in legacy router firmware, making exploitation more reliable than in modern desktop environments. The vulnerability can be triggered through authenticated HTTP POST requests, meaning an attacker needs valid administrative credentials but can then execute arbitrary code in the router's privileged context.

RemediationAI

No vendor-released patch identified at time of analysis. Belkin was contacted during coordinated disclosure but provided no response or remediation timeline per VulDB submission. Without official firmware updates, organizations and home users should implement defense-in-depth compensating controls immediately. Primary mitigations: (1) Disable remote management access and ensure the router's web interface is accessible only from trusted internal network segments, never exposed to the internet; (2) Change default administrative credentials to strong, unique passwords to raise the authentication barrier; (3) Implement network segmentation to isolate the router's management interface on a dedicated VLAN inaccessible to untrusted devices; (4) Monitor router logs for unusual formCrossBandSwitch requests or authentication attempts; (5) Consider replacing the device with alternative hardware from vendors with active security support programs, as the F9K1015 appears to be an end-of-life product without ongoing firmware maintenance. For enterprise environments, place affected routers behind next-generation firewalls with intrusion prevention systems configured to detect stack overflow exploitation patterns. Reference VulDB advisory at https://vuldb.com/vuln/355402 for ongoing updates, though vendor patch availability remains unlikely given non-responsiveness.

Share

CVE-2026-5611 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy