Introduction
Remote attackers can take full administrative control of Belkin F9K1009 and F9K1010 routers by logging in with credentials hard-coded into the firmware. Home and small business users who rely on these models to secure their networks are affected, and any device whose web interface is reachable from outside the trusted network is open to takeover.
Belkin is a well-known maker of consumer networking equipment, with millions of devices deployed worldwide. The F9K1009 and F9K1010 are common in homes and small offices, so this flaw reaches a broad base of users.
Technical information
CVE-2025-8730 comes from hard-coded authentication credentials in the web interface component of Belkin F9K1009 (firmware 2.00.09) and F9K1010 (firmware 2.00.04) routers. The credentials are stored directly in the firmware, and end users cannot change or remove them. Anyone who knows them can log in to the web interface with administrative access, whatever password the user has configured.
This vulnerability is classified under:
- CWE-259: Use of Hard-coded Password
- CWE-798: Use of Hard-coded Credentials
The attack works if the attacker can reach the router's web interface from their network location. That can happen if remote management is enabled, if port forwarding or UPnP is misconfigured, or if the attacker is on the local network. Once logged in, an attacker can change settings, intercept traffic, or install persistent malware on the device.
The proof-of-concept documentation and the hard-coded credentials themselves are both public, so exploitation is trivial for anyone who can reach the web interface.
Affected systems and versions
- Belkin F9K1009 router running firmware version 2.00.09
- Belkin F9K1010 router running firmware version 2.00.04
Only these two firmware versions are confirmed vulnerable. The public disclosure does not cover devices running other firmware versions.
Vendor security history
Critical vulnerabilities have turned up in Belkin's routers repeatedly. Notable examples include:
- N600 DB Wireless Dual-Band router (F9K1102 v2): multiple critical flaws, including DNS spoofing and credential theft (source)
- N150 Wireless Router (F9K1009 v1): HTML/script injection, authentication bypass, and CSRF (source)
Belkin's handling of vulnerability disclosures has been inconsistent, and some reports describe slow or absent communication and patching. As of this writing, Belkin has released no patch or official advisory for CVE-2025-8730.
