Cyber Posture

CVE-2026-5611

HighPublic PoC

Published: 06 April 2026

Published
06 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in Belkin F9K1015 1.00.10. This affects the function formCrossBandSwitch of the file /goform/formCrossBandSwitch. Performing a manipulation of the argument webpage results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made…

more

public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents stack-based buffer overflow by validating the 'webpage' argument in the formCrossBandSwitch function before processing.

prevent

Implements memory protection mechanisms such as stack canaries or non-executable stacks to block arbitrary code execution from the buffer overflow.

preventrecover

Requires timely identification, reporting, and remediation of flaws like this buffer overflow vulnerability in router firmware.

Security SummaryAI

CVE-2026-5611 is a stack-based buffer overflow vulnerability in the Belkin F9K1015 router running firmware version 1.00.10. The issue resides in the formCrossBandSwitch function within the /goform/formCrossBandSwitch file, where manipulation of the "webpage" argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.

Attackers with low privileges (PR:L), such as authenticated users on the network, can exploit this remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution, data theft, or device compromise. A public exploit is available, increasing the risk of widespread abuse.

VulDB advisories (e.g., vuln/355402) document the issue, noting early vendor contact with no response or patch issued. Practitioners should reference provided URLs like https://vuldb.com/vuln/355402 for CTI details and https://github.com/Litengzheng/vuldb_new/blob/main/Belkin%20F9K1015/vul_5/README.md for exploit information; mitigation relies on isolating affected devices, restricting access to the /goform endpoint, or upgrading firmware if available from Belkin.

The exploit's public disclosure heightens urgency for Belkin F9K1015 users, as no vendor remediation has been confirmed.

Details

CWE(s)

Affected Products

belkin
f9k1015 firmware
1.00.10

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Stack-based buffer overflow in router web form handler allows authenticated low-privilege users to achieve RCE and full device compromise, directly enabling exploitation for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References