F9k1122 EUVD-2026-19146

Belkin F9K1122 version 1.00.33. Attacker must have authenticated access to the device (PR:L). Send malicious input to /goform/formWlanSetup endpoint with crafted webpage parameter. No user interaction required.

The CVSS 8.8 severity reflects critical potential impact (high confidentiality, integrity, and availability loss) with network attack vector and low complexity. However, the PR:L component indicates authentication is required, significantly reducing the attack surface compared to unauthenticated flaws. Real-world risk depends on multiple factors: publicly available exploit code exists per GitHub reference, lowering attacker skill requirements and enabling automated scanning. No CISA KEV listing indicates this is not confirmed actively exploited at scale despite POC availability. The CVSS temporal metrics (E:P for proof-of-concept, RL:X for no official remediation) accurately capture the current state. For environments with exposed Belkin F9K1122 devices using default or weak credentials, this represents high practical risk given the combination of public exploit, no vendor patch, and complete system compromise potential. The SSVC framework would rate this as having proven exploitation status (POC available), automatable post-authentication, and total technical impact. Priority should be highest for internet-facing deployments or networks where lateral movement from compromised routers poses business risk.

An attacker who has obtained valid administrative credentials (through credential stuffing, default password reuse, or prior phishing) accesses the router's web management interface from the internet or local network. They craft an HTTP POST request to /goform/formWlanSetup containing a malicious 'webpage' parameter with carefully sized payload that overwrites the stack return address. When the formWlanSetup function returns, execution jumps to attacker-controlled shellcode embedded in the overflow buffer, granting complete control over the router. The attacker establishes persistent backdoor access, intercepts network traffic, modifies DNS responses to redirect users to phishing sites, or pivots to attack other devices on the trusted internal network. Public exploit code at the referenced GitHub repository provides ready-made tooling that lowers the technical barrier for opportunistic attackers scanning for vulnerable devices.