CVE-2026-5628
Stack-Based Buffer Overflow in Belkin F9K1015 Setting Handler
Publication date: 2026-04-06
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| belkin | f9k1015_firmware | 1.00.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Belkin F9K1015 firmware version 1.00.10 is a stack-based buffer overflow in the web interface, specifically in the function formSetSystemSettings.
This function processes a user-supplied parameter named "webpage," which is assigned to a variable and copied using the unsafe strcpy function without any length validation.
Because there is no boundary checking, an attacker can send a specially crafted HTTP POST request with an excessively long "webpage" parameter to overflow the buffer on the stack.
This overflow can lead to denial of service (DoS) or remote code execution (RCE) on the device.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow an attacker to remotely execute arbitrary code on the affected Belkin F9K1015 device.
This can lead to a denial of service (DoS), causing the device to crash or become unresponsive.
Remote code execution could allow attackers to take control of the device, potentially compromising network security and privacy.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for specially crafted HTTP POST requests sent to the endpoint /goform/formSetSystemSettings that contain an excessively long "webpage" parameter.
A detection method involves capturing network traffic and filtering for POST requests to /goform/formSetSystemSettings with unusually large payloads in the "webpage" parameter.
- Use a network packet capture tool like tcpdump or Wireshark to capture HTTP POST requests.
- Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) > 100)'
- Use grep or similar tools to search captured traffic for POST requests to /goform/formSetSystemSettings containing the "webpage" parameter.
- Example grep command on a captured file: grep -a 'POST /goform/formSetSystemSettings' capture.pcap | grep 'webpage='
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint and monitoring for exploit attempts.
- Block or restrict external network access to the /goform/formSetSystemSettings endpoint on the Belkin F9K1015 device.
- Implement network-level filtering or firewall rules to prevent malicious HTTP POST requests with large payloads targeting the "webpage" parameter.
- Monitor device logs and network traffic for signs of exploitation attempts.
Since the vendor has not responded with a patch, consider isolating the device from untrusted networks until a fix is available.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.