Executive brief
A security vulnerability exists in the Belkin F9K1015 wireless router. This flaw allows a remote attacker to crash the device or potentially take full control of it by sending a specially crafted web request. Such an exploit could lead to a complete loss of internet connectivity for the network or unauthorized access to the router's settings and traffic.
Technical details
A stack-based buffer overflow vulnerability exists in the Belkin F9K1015 firmware version 1.00.10. The flaw is located within the 'formWlEncrypt' function in the '/goform/formWlEncrypt' file. The vulnerability is caused by the unsafe use of the 'strcpy' function when processing the user-provided 'webpage' parameter, which is copied into a fixed-size stack buffer ('reboot_msg') without adequate length validation. A remote attacker with low privileges can exploit this by sending a POST request with an oversized 'webpage' argument, leading to a denial of service (DoS) or remote code execution (RCE). As of the advisory date, the vendor has not responded to disclosure attempts, and no patch is currently available.
Affected products
- Belkin F9K1015 1.00.10
Timeline
- 2026-04-05: disclosed: Vulnerability disclosed via VulDB and GitHub PoC.
- 2026-04-06: advisory: NVD publication date.