CVE-2025-11297
Published: 05 October 2025
Summary
CVE-2025-11297 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Belkin F9K1015 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11297 is a buffer overflow vulnerability in the Belkin F9K1015 router running firmware version 1.00.10. The issue resides in the processing of the /goform/formSetLanguage endpoint, where manipulation of the "webpage" argument triggers the overflow. This flaw is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), such as an authenticated user on the device. Successful exploitation allows arbitrary code execution, potentially granting high-impact confidentiality, integrity, and availability compromises, including full device takeover.
No patches or mitigations are available, as the vendor was contacted early for disclosure but provided no response. References include proof-of-concept exploit details on GitHub and entries on VulDB documenting the issue.
The exploit has been publicly disclosed, including a POC on GitHub, increasing the risk of active exploitation against unpatched Belkin F9K1015 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32236
Vulnerability details
A vulnerability was found in Belkin F9K1015 1.00.10. This issue affects some unknown processing of the file /goform/formSetLanguage. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit…
more
has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote buffer overflow in public-facing web endpoint (/goform/formSetLanguage) enables exploitation of public-facing application (T1190) and application/system exploitation for denial of service (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the 'webpage' argument in the /goform/formSetLanguage endpoint to prevent buffer overflow from improper input restrictions.
Implements memory safeguards such as ASLR and DEP to protect against arbitrary code execution resulting from the buffer overflow vulnerability.
Requires identification, reporting, and correction of the buffer overflow flaw through patching, workarounds, or system replacement despite vendor non-response.