F9K1015 CVE-2026-5614

Authenticated user with admin privileges must access the Belkin F9K1015 router running firmware 1.00.10. Attacker sends crafted input to /goform/formSetPassword endpoint with malicious webpage parameter to trigger stack-based buffer overflow.

This vulnerability presents elevated real-world risk despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects the critical impact (complete compromise of confidentiality, integrity, and availability) combined with network-based attack vector and low complexity. The CVSS temporal metrics show Exploit Maturity as Proof-of-Concept (E:P), confirmed by the GitHub repository containing working exploit code. While not in CISA KEV (no confirmed active exploitation), the combination of public exploit availability, outdated embedded device likely to remain unpatched, and potential for complete device compromise makes this a genuine threat. Home and small business routers are frequently targeted for botnet recruitment and man-in-the-middle attacks. The authentication requirement provides minimal protection since many users never change default credentials or use weak passwords. The vendor's non-responsiveness to disclosure (per description) signals likely absence of forthcoming patches, increasing long-term risk. SSVC framework indicators suggest elevated priority: exploitation is feasible (public POC), technical impact is total (system compromise), and the attack is potentially automatable once credentials are obtained through credential stuffing or default password exploitation.

An attacker identifies Belkin F9K1015 routers exposed to the internet via Shodan or similar scanning, then attempts default credentials (admin/admin or blank passwords commonly shipped with consumer routers) or previously compromised credentials from credential stuffing attacks. Once authenticated with low-privilege access to the web interface, the attacker crafts a malicious HTTP request to /goform/formSetPassword with an oversized 'webpage' parameter value exceeding the stack buffer allocation. This triggers the buffer overflow, allowing the attacker to overwrite the return address and redirect execution to injected shellcode. With successful exploitation, the attacker gains complete control of the router, enabling DNS hijacking to redirect users to phishing sites, installation of persistent backdoors, traffic interception for credential harvesting, or recruitment into DDoS botnets. The publicly available GitHub exploit code significantly lowers technical barriers, making this attack accessible to moderately skilled threat actors.