CVE-2025-11293
Published: 05 October 2025
Summary
CVE-2025-11293 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Belkin F9K1015 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11293 is a buffer overflow vulnerability affecting the Belkin F9K1015 router running firmware version 1.00.10. The issue resides in an unknown functionality exposed via the /goform/formConnectionSetting endpoint, where manipulation of the max_Conn argument triggers the overflow. This flaw, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user on the device, requiring no user interaction and low attack complexity. Successful exploitation allows the attacker to achieve high levels of confidentiality, integrity, and availability impacts, potentially enabling arbitrary code execution, data compromise, or denial of service on the affected router.
Advisories from VulDB and a public GitHub repository detail the vulnerability, including a proof-of-concept exploit targeting the formConnectionSetting endpoint. No patches or vendor responses are available, as Belkin was contacted prior to disclosure but did not reply. Security practitioners should isolate affected devices and monitor for exploitation attempts using the disclosed POC.
The exploit has been publicly disclosed and is available for use, increasing the risk of immediate attacks against unpatched Belkin F9K1015 routers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32234
Vulnerability details
A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality of the file /goform/formConnectionSetting. The manipulation of the argument max_Conn leads to buffer overflow. The attack may be initiated remotely. The exploit…
more
has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the remotely accessible web interface (/goform/formConnectionSetting) of the Belkin F9K1015 router enables exploitation of a public-facing application, with public PoC available.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of the max_Conn input to the /goform/formConnectionSetting endpoint, directly preventing the buffer overflow exploitation.
Implements memory protections like ASLR, DEP, and stack canaries to mitigate successful exploitation of the buffer overflow vulnerability.
Supports timely flaw remediation through firmware updates, isolation, or replacement of the vulnerable Belkin F9K1015 router despite lack of vendor patch.