F9K1015 Firmware CVE-2026-5629

Requires authenticated access to Belkin F9K1015 firmware version 1.00.10. Attacker must be logged into the device's web interface to send crafted requests to /goform/formSetFirewall endpoint with malicious webpage parameter to trigger stack-based buffer overflow.

Real-world risk assessment requires balancing multiple signals that present a nuanced picture. The CVSS 4.0 score of 7.4 reflects high potential impact (complete device compromise) with network attack vector and low complexity, but critically requires authenticated access (PR:L), significantly reducing the attack surface compared to unauthenticated remote code execution. The proof-of-concept exploit availability (E:P in CVSS vector, confirmed by public GitHub repository) substantially elevates risk beyond theoretical vulnerabilities, as adversaries can weaponize existing code rather than developing exploits from scratch. However, no CISA KEV listing indicates this vulnerability is not confirmed as actively exploited in real-world campaigns. The affected product is a legacy Belkin consumer router (F9K1015) with firmware from approximately 2013-2015 era, suggesting limited deployment in modern enterprise environments but potentially significant presence in small office/home office (SOHO) networks where hardware refresh cycles are longer. The requirement for authentication means attackers need valid credentials first, making this vulnerability more suitable for credential-stuffing follow-on attacks or exploitation of routers with default/weak passwords rather than mass internet-scanning campaigns. The vendor's non-response to disclosure indicates no official patch will be forthcoming, converting this into a permanent risk for users who continue operating affected hardware. Overall assessment: Medium-high priority for environments still running this hardware, particularly where default credentials may be in use, but not a critical drop-everything patch priority given authentication requirements and lack of confirmed active exploitation.

An attacker targets a small business using a Belkin F9K1015 router that retains default administrative credentials or has weak passwords discoverable through credential stuffing attacks. After successfully authenticating to the router's web interface (commonly accessible on local networks or if remote management is enabled), the attacker crafts a malicious HTTP request to the /goform/formSetFirewall endpoint with an oversized 'webpage' parameter value exceeding the stack buffer allocation. The stack-based buffer overflow overwrites the return address or function pointers, redirecting execution to attacker-controlled shellcode embedded in the overflow payload. With publicly available proof-of-concept code from the GitHub repository, the attacker can execute arbitrary code with the privilege level of the router's web server process, typically root or equivalent on embedded devices. This grants complete control over the router, enabling persistent backdoor installation, traffic interception and manipulation, internal network reconnaissance, DNS hijacking to redirect users to phishing sites, or using the compromised router as a pivot point for lateral movement into the business network.