rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-7069 HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: HDF5
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: JJLeo (VulDB User)
Published: 2025-07-04T21:02:06.876Z
CVE-2025-7070 IROAD Dashcam Q9 MFA Pairing Request allocation of resources
A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-770
description: Allocation of Resources
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: IROAD
product: Dashcam Q9
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: geochen (VulDB User)
Published: 2025-07-04T21:32:07.349Z
CVE-2025-7071 Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
Problem types: cwe_id: CWE-208
description: CWE-208 Observable Timing Discrepancy
cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Oberon microsystems AG
product: ocrypto
default_status: unaffected
Published: 2025-08-29T09:18:06.911Z
CVE-2025-7072 Hardcoded credentials in KAON CG3000T/CG3000CT routers
The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges.
This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: KAON
product: CG3000T
default_status: unaffected
vendor: KAON
product: CG3000TC
default_status: unaffected
Credits: lang: en
value: Piotr Ługowski
Published: 2026-01-09T11:30:24.672Z
CVE-2025-7073 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Bitdefender
product: Total Security
default_status: unaffected
vendor: Bitdefender
product: Internet Security
default_status: unaffected
vendor: Bitdefender
product: Antivirus Plus
default_status: unaffected
Credits: lang: en
value: Filip Dragovic (@filip_dragovic)
Published: 2025-12-10T09:46:40.263Z
CVE-2025-7074 vercel hyper rimraf-standalone.js ignoreMap redos
A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: vercel
product: hyper
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: DayShift (VulDB User)
Published: 2025-07-05T09:02:05.339Z
CVE-2025-7075 BlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted upload
A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /upload.cgi of the component HTTP Endpoint. The manipulation leads to unrestricted upload. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: BlackVue
product: Dashcam 590X
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: geochen (VulDB User)
Published: 2025-07-05T23:32:05.317Z
CVE-2025-7076 BlackVue Dashcam 590X Configuration upload.cgi access control
A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.cgi of the component Configuration Handler. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: BlackVue
product: Dashcam 590X
CVSS v3.1: version: 3.1
baseScore: 5.4
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:W/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: geochen (VulDB User)
Published: 2025-07-06T00:02:04.767Z
CVE-2025-7077 Shenzhen Libituo Technology LBT-T300-T310 appy.cgi config_3g_para buffer overflow
A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config_3g_para of the file /appy.cgi. The manipulation of the argument username_3g/password_3g leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Shenzhen Libituo Technology
product: LBT-T300-T310
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: FLY200503 (VulDB User)
Published: 2025-07-06T06:32:05.492Z
CVE-2025-7078 07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery
A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: n/a
product: 07FLYCMS
vendor: n/a
product: 07FLY-CMS
vendor: n/a
product: 07FlyCRM
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Excent1c (VulDB User)
Published: 2025-07-06T08:32:05.396Z
CVE-2025-7079 mao888 bluebell-plus JWT Token jwt.go hard-coded password
A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-259
description: Use of Hard-coded Password
cwe_id: CWE-255
description: Credentials Management
Affected products: vendor: mao888
product: bluebell-plus
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Tritium (VulDB User)
Published: 2025-07-06T12:32:05.291Z
CVE-2025-7080 Done-0 Jank JWT Token jwt_utils.go hard-coded password
A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the argument accessSecret/refreshSecret with the input jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
Problem types: cwe_id: CWE-259
description: Use of Hard-coded Password
cwe_id: CWE-255
description: Credentials Management
Affected products: vendor: Done-0
product: Jank
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Tritium (VulDB User)
Published: 2025-07-06T13:02:05.867Z
CVE-2025-7081 Belkin F9K1122 webs formSetWanStatic os command injection
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 is directly passed by the attacker/so we can control the m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Bond (VulDB User)
Published: 2025-07-06T13:32:04.709Z
CVE-2025-7082 Belkin F9K1122 webs formBSSetSitesurvey os command injection
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/wan_gateway/wl_ssid is directly passed by the attacker/so we can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Bond (VulDB User)
Published: 2025-07-06T14:02:05.329Z
CVE-2025-7083 Belkin F9K1122 webs mp os command injection
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Bond (VulDB User)
Published: 2025-07-06T15:32:05.292Z
CVE-2025-7084 Belkin F9K1122 webs formWpsStart stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the function formWpsStart of the file /goform/formWpsStart of the component webs. The manipulation of the argument pinCode leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Bond (VulDB User)
Published: 2025-07-06T16:02:05.557Z
CVE-2025-7085 Belkin F9K1122 webs formiNICWpsStart stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. This issue affects the function formiNICWpsStart of the file /goform/formiNICWpsStart of the component webs. The manipulation of the argument pinCode leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T16:32:05.008Z
CVE-2025-7086 Belkin F9K1122 webs formPPTPSetup stack-based overflow
A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33. Affected is the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T17:02:08.800Z
CVE-2025-7087 Belkin F9K1122 webs formL2TPSetup stack-based overflow
A vulnerability classified as critical was found in Belkin F9K1122 1.00.33. Affected by this vulnerability is the function formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T17:32:05.280Z
CVE-2025-7088 Belkin F9K1122 webs formPPPoESetup stack-based overflow
A vulnerability, which was classified as critical, was found in Belkin F9K1122 1.00.33. This affects the function formPPPoESetup of the file /goform/formPPPoESetup of the component webs. The manipulation of the argument pppUserName leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T18:02:06.558Z
CVE-2025-7089 Belkin F9K1122 webs formWanTcpipSetup stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. This issue affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component webs. The manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T18:32:04.914Z
CVE-2025-7090 Belkin F9K1122 webs formConnectionSetting stack-based overflow
A vulnerability, which was classified as critical, has been found in Belkin F9K1122 1.00.33. Affected by this issue is the function formConnectionSetting of the file /goform/formConnectionSetting of the component webs. The manipulation of the argument max_Conn/timeOut leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T19:02:06.107Z
CVE-2025-7091 Belkin F9K1122 webs formWlanMP stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. Affected is the function formWlanMP of the file /goform/formWlanMP of the component webs. The manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T19:32:05.446Z
CVE-2025-7092 Belkin F9K1122 webs formWlanSetupWPS stack-based overflow
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. This vulnerability affects the function formWlanSetupWPS of the file /goform/formWlanSetupWPS of the component webs. The manipulation of the argument wps_enrolee_pin/webpage leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T20:02:05.250Z
CVE-2025-7093 Belkin F9K1122 webs formSetLanguage stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. Affected by this vulnerability is the function formSetLanguage of the file /goform/formSetLanguage of the component webs. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T20:32:05.782Z
CVE-2025-7094 Belkin F9K1122 webs formBSSetSitesurvey stack-based overflow
A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument submit-url-ok leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Belkin
product: F9K1122
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-07-06T21:02:04.949Z