CVE-2025-11294
BaseFortify
Publication date: 2025-10-05
Last updated on: 2025-10-07
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| belkin | f9k1015_firmware | 1.00.10 |
| belkin | f9k1015 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11294 is a critical buffer overflow vulnerability in the Belkin F9K1015 router firmware version 1.00.10. It occurs in the handling of the L2TPUserName parameter via the HTTP endpoint /goform/formL2TPSetup. The vulnerability arises because the input buffer is copied to an output buffer without verifying that the input size fits, leading to memory corruption. This can be exploited remotely by sending specially crafted requests, potentially allowing arbitrary code execution or denial of service. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow a remote attacker to execute arbitrary code on the affected Belkin router or cause it to crash, resulting in denial of service. This compromises the confidentiality, integrity, and availability of the device, potentially allowing attackers to take control of the router or disrupt network services. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the endpoint /goform/formL2TPSetup and checking for unusually long or malformed L2TPUserName parameters that could trigger a buffer overflow. Network intrusion detection systems (NIDS) can be configured to alert on such suspicious requests. Additionally, using tools like curl or wget to send crafted requests to the vulnerable endpoint can help verify if the system is affected. Example command to test the endpoint: curl -X POST http://<router-ip>/goform/formL2TPSetup -d "L2TPUserName=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". However, no specific detection commands are provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of the affected Belkin F9K1015 router firmware version 1.00.10, as no patches or vendor mitigations are available. Consider replacing the affected device with an alternative product. Additionally, restrict network access to the router's management interface to trusted networks only, and monitor for suspicious activity targeting the /goform/formL2TPSetup endpoint. Applying network-level protections such as firewalls or intrusion prevention systems to block exploit attempts is also recommended. [2]