CVE-2026-5611
Stack-Based Buffer Overflow in Belkin F9K1015 Remote Form Function
Publication date: 2026-04-06
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| belkin | f9k1015_firmware | 1.00.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2026-5611 vulnerability affects the Belkin F9K1015 router, version 1.00.10. It is a stack-based buffer overflow found in the router's web interface, specifically within the formCrossBandSwitch function.
This function processes a user-supplied parameter named "webpage." The vulnerability arises because the variable p_reboot_msg, which holds this parameter, is passed directly to the strcpy function without any length validation.
This lack of bounds checking allows an attacker to overflow the stack buffer reboot_msg by sending a crafted HTTP POST request with an excessively long "webpage" parameter to the endpoint /goform/formCrossBandSwitch.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to denial of service (DoS) or remote code execution (RCE) on the affected device.
- Denial of Service (DoS) - The device may crash or become unresponsive.
- Remote Code Execution (RCE) - An attacker could execute arbitrary code remotely, potentially taking full control of the device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests sent to the endpoint /goform/formCrossBandSwitch containing an excessively long or oversized "webpage" parameter.
A practical detection method is to capture and analyze network traffic to identify such suspicious POST requests targeting the vulnerable router.
- Use a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to /goform/formCrossBandSwitch.
- Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/formCrossBandSwitch'
- Alternatively, use curl or similar tools to test the endpoint by sending a crafted POST request with a large "webpage" parameter to see if the device responds abnormally.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable router's web interface to trusted networks only, such as by using firewall rules or network segmentation.
Avoid exposing the router's management interface to the internet to prevent remote exploitation.
Monitor for suspicious POST requests to /goform/formCrossBandSwitch and block or alert on such traffic.
If possible, update the router firmware to a version that addresses this vulnerability; however, the vendor has not responded to this disclosure, so an official patch may not be available.
As a temporary workaround, consider disabling remote management features or replacing the affected device with a more secure alternative.