critical advisory March 29, 2026

Belkin F9K1122 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability (CVE-2026-5044) in Belkin F9K1122 version 1.00.33 allows remote attackers to execute arbitrary code by manipulating the 'webpage' argument in the formSetSystemSettings function, potentially leading to complete system compromise.

Triage facts

Severity: Critical
Sources: 3 public sources
Freshness: PublishedMar 29, 13:17 UTC
Detection: 2 rules

A critical security vulnerability, CVE-2026-5044, has been identified in Belkin F9K1122 router version 1.00.33. The vulnerability resides within the formSetSystemSettings function of the /goform/formSetSystemSettings file, which is part of the Setting Handler component. Successful exploitation allows a remote attacker to trigger a stack-based buffer overflow by manipulating the webpage argument. This could result in arbitrary code execution on the device. Publicly available exploit code…

Detection coverage 2

Detect Belkin F9K1122 Buffer Overflow Attempt

critical

Detects attempts to exploit CVE-2026-5044 by monitoring HTTP POST requests to the vulnerable endpoint with overly long webpage parameters.

sigma tactics: execution techniques: T1210 sources: webserver, linux

Detect Belkin F9K1122 Buffer Overflow Traffic Volume

medium

Detects abnormally high network traffic to the vulnerable endpoint, indicating potential scanning or exploitation attempts.

sigma tactics: discovery techniques: T1046 sources: network_connection, linux

Detection queries are available on the platform. Get full rules →