Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Belkin F9K1015 1.00.10. The affected element is the function formSetFirewall of the file /goform/formSetFirewall. The manipulation of the argument webpage results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in Belkin F9K1015 wireless router firmware 1.00.10 enables authenticated remote attackers to achieve complete device compromise via the formSetFirewall firewall configuration function. The vulnerability has publicly available exploit code and carries an EPSS exploitation probability that warrants attention, though no active exploitation has been confirmed by CISA KEV at time of analysis. The vendor (Belkin) was notified but did not respond, leaving legacy hardware users without an official remediation path.
Technical ContextAI
This vulnerability affects the formSetFirewall function in the /goform/formSetFirewall endpoint of Belkin F9K1015 wireless router firmware version 1.00.10. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically manifesting as a stack-based buffer overflow. The vulnerability occurs when processing the 'webpage' argument during firewall configuration operations. Stack-based buffer overflows occur when user-controlled input exceeds the allocated stack buffer size without proper bounds checking, allowing attackers to overwrite adjacent memory including return addresses and function pointers. In embedded device web interfaces like this Belkin router, such flaws often arise from unsafe string handling functions (strcpy, sprintf) used to process HTTP POST parameters. The CVSS 4.0 vector indicates network accessibility with low attack complexity, requiring low-privilege authentication, and delivering high impact to confidentiality, integrity, and availability of the vulnerable component with proof-of-concept code confirmed available (E:P metric).
RemediationAI
No vendor-released patch is available for this vulnerability. Belkin was contacted during responsible disclosure but did not respond, and the F9K1015 product line has reached end-of-life with no further firmware updates expected. The primary remediation is hardware replacement with a currently supported router model from any vendor that receives active security updates. Organizations and home users still operating Belkin F9K1015 devices should prioritize migration to modern hardware as the only permanent solution. Interim risk-reduction measures for environments where immediate replacement is not feasible include: disabling remote administration features entirely and ensuring administrative access is only possible from trusted internal network segments; implementing network segmentation to isolate the vulnerable router from critical assets; enforcing strong unique administrative passwords (not default credentials) and rotating them regularly; monitoring logs for unusual formSetFirewall endpoint access patterns; and considering placement of the Belkin device behind a more secure edge router if it must remain in service. Reference the VulDB disclosure at https://vuldb.com/vuln/355417 and the proof-of-concept repository at https://github.com/Litengzheng/vuldb_new/blob/main/Belkin%20F9K1015/vul_13/README.md for technical details. Given the authentication requirement, restricting administrative access provides meaningful risk reduction until hardware replacement is completed.
More in F9K1015 Firmware
View allCommand injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-19182
GHSA-m47x-pvpv-3jg6