The vulnerability arises from a stack-based buffer overflow in the formSetPassword function found in the Belkin F9K1015 firmware. An attacker can send a crafted request that overflows the buffer by manipulating the 'webpage' argument sent to the /goform/formSetPassword endpoint. Because the overflow occurs on the stack, a successful exploitation allows an attacker to execute arbitrary code with the privileges of the device, giving full control over the system. This flaw falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-121 (Stack-Based Buffer Overflow).

The affected device is the Belkin F9K1015, running firmware version 1.00.10. Only the firmware version 1.00.10 is documented as vulnerable; earlier or newer versions are not listed as affected in the available data.

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS score is available, but the public release of an exploit demonstrates that attackers already have access to working payloads. The flaw is not listed in the CISA KEV catalog yet. Exploitation requires sending HTTP requests to the device's management interface, which is accessible remotely, meaning an attacker can target the device from the internet if the network permits. Given the high severity and the availability of a public exploit, the risk to exposed devices is substantial.