PT-2025-28080 · Belkin · Belkin F9K1122

Pjqwudi

·

Published

2025-06-25

·

Updated

2025-07-11

·

CVE-2025-7086

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33
Description: A critical vulnerability has been found in the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to a stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Recommendations: For Belkin F9K1122 version 1.00.33, as a temporary workaround, consider disabling the formPPTPSetup function until a patch is available. Restrict access to the /goform/formPPTPSetup endpoint to minimize the risk of exploitation. Avoid using the parameter pptpUserName in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121CWE-119

Related Identifiers

BDU:2025-08098
CVE-2025-7086

Affected Products

Belkin F9K1122