PT-2025-28083 · Belkin · Belkin F9K1122

Pjqwudi

·

Published

2025-06-25

·

Updated

2025-07-11

·

CVE-2025-7089

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Belkin F9K1122 version 1.00.33
Description: A critical issue affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component webs. The manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Recommendations: For Belkin F9K1122 version 1.00.33, as a temporary workaround, consider disabling the formWanTcpipSetup function until a patch is available. Restrict access to the /goform/formWanTcpipSetup endpoint to minimize the risk of exploitation. Avoid using the parameter pppUserName in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121CWE-119

Related Identifiers

BDU:2025-08127
CVE-2025-7089

Affected Products

Belkin F9K1122