CVE-2025-7081
BaseFortify
Publication date: 2025-07-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| belkin | f9k1122_firmware | 1.00.33 |
| belkin | f9k1122 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7081 is an OS command injection vulnerability in the Belkin F9K1122 router firmware version 1.00.33. It exists in the function formSetWanStatic, where certain parameters (m_wan_ipaddr, m_wan_netmask, m_wan_gateway, m_wan_staticdns1, m_wan_staticdns2) are taken from user input and passed directly to operating system commands without proper sanitization. This allows a remote attacker to inject and execute arbitrary OS commands on the device via specially crafted requests to the /goform/formSetWanStatic endpoint. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized remote execution of arbitrary operating system commands on the affected router. This compromises the confidentiality, integrity, and availability of the device, potentially allowing attackers to take control of the router, disrupt network services, intercept or manipulate data, and use the device as a foothold for further attacks. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for HTTP requests targeting the endpoint /goform/formSetWanStatic with suspicious or unusual parameters in m_wan_ipaddr, m_wan_netmask, m_wan_gateway, m_wan_staticdns1, or m_wan_staticdns2 that may contain command injection payloads. Since the exploit is publicly available, scanning for such requests or using intrusion detection systems (IDS) with signatures for command injection attempts on this endpoint can help detect exploitation attempts. Specific commands are not provided in the resources, but monitoring HTTP POST requests to /goform/formSetWanStatic and inspecting parameter values for shell metacharacters or unusual input is recommended. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected Belkin F9K1122 device with an alternative product, as no known countermeasures or patches are available. Since the vendor did not respond or provide any fixes, discontinuing use of the vulnerable firmware version 1.00.33 and isolating the device from untrusted networks to prevent remote exploitation is advised. [2]