CVE-2026-5044
Published: 29 March 2026
Summary
CVE-2026-5044 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Belkin F9K1122 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5044 is a stack-based buffer overflow vulnerability affecting the Belkin F9K1122 router on firmware version 1.00.33. The issue resides in the formSetSystemSettings function within the /goform/formSetSystemSettings file of the Setting Handler component, where manipulation of the "webpage" argument triggers the overflow. Published on 2026-03-29, it is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 8.8 (S:U/C:H/I:H/A:H). An authenticated attacker with network access can send a specially crafted request to overflow the stack, potentially achieving arbitrary code execution, data corruption, or denial of service on the affected device.
Advisories from VulDB and a related GitHub repository detail the vulnerability but note that the vendor was contacted early regarding disclosure and did not respond. No patches, workarounds, or official mitigations have been provided by Belkin. The exploit code has been publicly disclosed and may be actively used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16991
Vulnerability details
A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to stack-based buffer overflow. The attack can be executed…
more
remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable stack-based buffer overflow in a public-facing router web interface (formSetSystemSettings), enabling arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and sanitizes the 'webpage' argument in the formSetSystemSettings function to prevent stack-based buffer overflows from specially crafted inputs.
Deploys stack canaries, address space layout randomization, and non-executable stack protections to mitigate exploitation of the stack-based buffer overflow vulnerability.
Monitors for and applies firmware patches or replacements to remediate the known stack-based buffer overflow in Belkin F9K1122 firmware version 1.00.33.