CVE-2025-7092

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. This vulnerability affects the function formWlanSetupWPS of the file /goform/formWlanSetupWPS of the component webs. The manipulation of the argument wps_enrolee_pin/webpage leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Belkin	F9K1122	1.00.33

References

https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_12/12.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_12/12.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.315004Permissions Required
https://vuldb.com/?id.315004Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603701Third Party Advisory, VDB Entry
https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_12/12.mdExploit, Third Party Advisory

Timeline

Published: Jul 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-70938.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. Affected by this vulnerability is the function formSe CVE-2025-709365.4Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controll CVE-2025-70948.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. Affected by this issue is the function formBSSetSitesurv CVE-2025-709489.3A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exe CVE-2025-709497.5An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.CVE-2025-70956.1A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the c CVE-2025-709507.3An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.CVE-2025-709527.5pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names c CVE-2025-709547.5A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is loc CVE-2025-709557.5A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper ha CVE-2025-709567.5A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in the RUNVM instruction l CVE-2025-709577.5A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling of