CVE-2025-11303
📋 TL;DR
This CVE describes a command injection vulnerability in Belkin F9K1015 routers. Attackers can remotely execute arbitrary commands by manipulating the 'command' parameter in the /goform/mp file. All users of affected Belkin F9K1015 routers with vulnerable firmware are at risk.
💻 Affected Systems
- Belkin F9K1015
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Attackers gain shell access to execute commands, potentially installing malware, creating backdoors, or modifying router configuration.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access, though internal attackers could still exploit.
🎯 Exploit Status
Public proof-of-concept available; exploitation requires simple HTTP requests with command injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider replacing affected hardware.
🔧 Temporary Workarounds
Block Web Interface Access
linuxRestrict access to router web interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s ! TRUSTED_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! TRUSTED_NETWORK -j DROP
Disable Remote Administration
allTurn off remote administration features in router settings
🧯 If You Can't Patch
- Replace affected Belkin F9K1015 routers with supported, patched alternatives
- Segment affected routers on isolated network segments with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.2.1 or using curl: curl -s http://ROUTER_IP/goform/mp?command=idCheck Version:
curl -s http://ROUTER_IP/ | grep -i firmware || ssh admin@ROUTER_IP 'show version'Verify Fix Applied:
No fix available to verify; monitor for vendor firmware updates📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/mp
- Commands like 'id', 'whoami', 'wget', 'curl' in URL parameters
- Multiple failed authentication attempts followed by successful /goform/mp access
Network Indicators:
- HTTP requests to /goform/mp with shell metacharacters (;, |, &, $)
- Outbound connections from router to unusual IPs/ports
- DNS queries for command-and-control domains
SIEM Query:
source="router_logs" AND (url="/goform/mp" AND (param="command" AND value MATCHES "[;&|$()]"))🔗 References
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md#poc
- https://vuldb.com/?ctiid.327184
- https://vuldb.com/?id.327184
- https://vuldb.com/?submit.661307
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md
- https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md#poc
