A stack-based buffer overflow exists in the formReboot function of the /goform/formReboot page on Belkin F9K1122 firmware 1.00.33. The vulnerability is triggered through a manipulated web form argument and can be invoked remotely. The output of the CVE description does not explicitly state that the overflow results in arbitrary code execution; this is a reasonable inference based on typical stack overflows, but it is not confirmed by the vendor or the disclosure material.

Devices running Belkin F9K1122 firmware version 1.00.33 are affected. The corresponding CPE identifier is cpe:2.3:o:belkin:f9k1122_firmware:*:*:*:*:*:*:*:*.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require only remote access to the device’s HTTP interface and the ability to send a specially crafted request to /goform/formReboot, as demonstrated in publicly disclosed proof‑of‑concept code. No vendor patch or workaround is currently available, so the risk remains unless mitigated.