PT-2025-28081 · Belkin · Belkin F9K1122
Pjqwudi
·
Published
2025-06-25
·
Updated
2025-07-11
·
CVE-2025-7087
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Belkin F9K1122 version 1.00.33
Description:
A critical vulnerability was found in the function
formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to a stack-based buffer overflow. The attack can be launched remotely. The vendor was contacted about this disclosure but did not respond.Recommendations:
For Belkin F9K1122 version 1.00.33, as a temporary workaround, consider disabling the
formL2TPSetup function until a patch is available. Restrict access to the /goform/formL2TPSetup endpoint to minimize the risk of exploitation. Avoid using the argument L2TPUserName in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Belkin F9K1122