A critical stack-based buffer overflow vulnerability in Belkin F9K1122 firmware version 1.00.33 exposes devices to potential remote code execution and denial of service.

The device suffers from a stack-based buffer overflow in the formReboot function, located within the /goform/formReboot endpoint. By providing a malicious webpage parameter, an authenticated attacker can trigger memory corruption through an unchecked strcpy operation.

The ability for an attacker to achieve remote code execution poses a severe risk to network integrity and confidentiality. Successful exploitation could allow an unauthorized party to gain control over the router, facilitate lateral movement within the network, or cause persistent system instability. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized access to critical infrastructure.

Immediate Action: As there is currently no official patch from the vendor, users should restrict access to the router management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /goform/formReboot endpoint and investigate any unexpected router reboots or service interruptions.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to filter malicious POST payloads containing excessively long webpage parameters.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up by Li Tengzheng.

Due to the lack of a vendor-provided security update, users must treat this device as high-risk and implement rigorous network segmentation. Organizations should prioritize replacing or isolating these routers from internet-facing environments to mitigate the threat of remote code execution until a definitive patch is released.