CVE-2026-4566

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
Belkin	F9K1122	1.00.33

References

https://github.com/Litengzheng/vul_db/blob/main/Belkin/vul_151/README.mdExploit, Third Party Advisory
https://github.com/Litengzheng/vul_db/blob/main/Belkin/vul_151/README.md#proof-of-concept-pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.352403Permissions Required, VDB Entry
https://vuldb.com/?id.352403Third Party Advisory, VDB Entry
https://vuldb.com/?submit.775132Third Party Advisory, VDB Entry

Timeline

Published: Mar 23, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-456605.4Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation c CVE-2026-456619.9Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokp CVE-2026-456628.8Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/serve CVE-2026-456639.9Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker CVE-2026-456645.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, bec CVE-2026-456658.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scrip CVE-2026-456666.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{n CVE-2026-456676.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef i CVE-2026-456689.3Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2 CVE-2026-456695.4Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigat CVE-2026-45679.8A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The CVE-2026-456705.4Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.2