A stack‑based buffer overflow exists in the formWlanSetup function of the Belkin F9K1122 router firmware version 1.00.33. The flaw is triggered when the non‑validated "webpage" argument of the /goform/formWlanSetup endpoint is supplied with a malicious payload, allowing an attacker to explode a stack buffer and potentially execute arbitrary code. The vulnerability description states it can be exercised remotely, indicating that the web interface is the attack surface and that no access controls prevent exploitation.

Only Belkin F9K1122 units running firmware 1.00.33 are known to be affected; no other models or firmware revisions are listed.

With a CVSS score of 8.7 the flaw is considered high severity, and the EPSS score of less than 1% still indicates that exploitation is possible, particularly because the proof‑of‑concept is publicly available and the vendor has not released a fix. The exploit is performed over the network via the device’s web interface, so any host able to reach the router can attempt the attack. The vulnerability is not listed in CISA’s KEV catalog, but the lack of a vendor patch combined with the publicly documented exploit raises a significant risk of remote compromise, including full control of the device and its network. The primary attack vector is remote HTTP traffic aimed at the vulnerable endpoint.