Cyber Posture

CVE-2026-5044

HighPublic PoC

Published: 29 March 2026

Published
29 March 2026
Modified
30 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to stack-based buffer overflow. The attack can be executed…

more

remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates and sanitizes the 'webpage' argument in the formSetSystemSettings function to prevent stack-based buffer overflows from specially crafted inputs.

preventdetect

Deploys stack canaries, address space layout randomization, and non-executable stack protections to mitigate exploitation of the stack-based buffer overflow vulnerability.

prevent

Monitors for and applies firmware patches or replacements to remediate the known stack-based buffer overflow in Belkin F9K1122 firmware version 1.00.33.

Security SummaryAI

CVE-2026-5044 is a stack-based buffer overflow vulnerability affecting the Belkin F9K1122 router on firmware version 1.00.33. The issue resides in the formSetSystemSettings function within the /goform/formSetSystemSettings file of the Setting Handler component, where manipulation of the "webpage" argument triggers the overflow. Published on 2026-03-29, it is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).

The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 8.8 (S:U/C:H/I:H/A:H). An authenticated attacker with network access can send a specially crafted request to overflow the stack, potentially achieving arbitrary code execution, data corruption, or denial of service on the affected device.

Advisories from VulDB and a related GitHub repository detail the vulnerability but note that the vendor was contacted early regarding disclosure and did not respond. No patches, workarounds, or official mitigations have been provided by Belkin. The exploit code has been publicly disclosed and may be actively used by attackers.

Details

CWE(s)

Affected Products

belkin
f9k1122 firmware
1.00.33

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remotely exploitable stack-based buffer overflow in a public-facing router web interface (formSetSystemSettings), enabling arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References