CVE-2025-11301
📋 TL;DR
A remote buffer overflow vulnerability exists in Belkin F9K1015 routers via the /goform/formWlanSetupWPS endpoint. Attackers can exploit this to potentially execute arbitrary code or crash the device. All users of Belkin F9K1015 routers running firmware version 1.00.10 are affected.
💻 Affected Systems
- Belkin F9K1015 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Device crash causing denial of service, or limited code execution allowing network reconnaissance.
If Mitigated
If properly segmented and monitored, impact limited to isolated device compromise without lateral movement.
🎯 Exploit Status
Public proof-of-concept available, exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices with supported models.
🔧 Temporary Workarounds
Block vulnerable endpoint
linuxUse firewall rules to block access to /goform/formWlanSetupWPS endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/formWlanSetupWPS" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/goform/formWlanSetupWPS" --algo bm -j DROP
Disable WPS feature
allTurn off WPS functionality in router settings if possible
🧯 If You Can't Patch
- Isolate affected routers in separate network segment with strict firewall rules
- Replace affected devices with supported models that receive security updates
🔍 How to Verify
Check if Vulnerable:
Check router web interface for firmware version 1.00.10 or attempt to access /goform/formWlanSetupWPS endpointCheck Version:
Check router web interface under Settings > Firmware or via SSH if availableVerify Fix Applied:
Verify firmware version is updated beyond 1.00.10 or test endpoint is no longer accessible/exploitable📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to /goform/formWlanSetupWPS
- Unusual POST requests with long parameter values
- Router crash/reboot logs
Network Indicators:
- HTTP requests to router IP with /goform/formWlanSetupWPS path
- Unusual outbound connections from router after exploitation
SIEM Query:
source="router_logs" AND (uri="/goform/formWlanSetupWPS" OR message="buffer overflow" OR message="crash")🔗 References
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formWlanSetupWPS.md
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formWlanSetupWPS.md#poc
- https://vuldb.com/?ctiid.327182
- https://vuldb.com/?id.327182
- https://vuldb.com/?submit.661305
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formWlanSetupWPS.md
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formWlanSetupWPS.md#poc
