HighPublic exploit

Hard-coded Credentials in Belkin F9K1009/F9K1010 Web Interface

IdentifiersCVE-2025-8730CWE-798· Use of Hard-coded Credentials

CVE-2025-8730 is a critical vulnerability affecting Belkin F9K1009 and F9K1010 devices running firmware versions 2.00.04 and 2.00.09. The issue is in the web interface and results from the presence of hard-coded credentials in unspecified functionality. Because the vulnerable component is remotely reachable, an attacker can exploit the issue over the network without local access. Public disclosure indicates exploit details are available, but the specific function or code path involved is not provided in the available content.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to authenticate to the affected device using embedded credentials not intended to be user-controlled. This can enable unauthorized administrative or privileged access to the router's web interface, potentially allowing configuration changes, access to sensitive device information, weakening of network security settings, and establishment of persistent control over the device.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the device web interface to trusted management networks only. Disable remote administration from untrusted networks or the Internet if enabled. Place affected devices behind upstream access controls, firewall rules, or VPN-only administrative access. Continuously monitor for unauthorized configuration changes and administrative logins. If the device cannot be adequately isolated and no vendor fix is available, remove or replace the affected hardware.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed firmware release if one becomes available. Because the available content does not identify a patch or fixed version and notes that the vendor did not respond to the disclosure, organizations should monitor Belkin for security advisories and updated firmware for F9K1009 and F9K1010 devices. If no fix is available, replacement of affected devices should be considered.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

CVE-2025-8730MaturityPoCVerified exploit

This repository contains a proof-of-concept exploit for CVE-2025-8730, an authentication bypass vulnerability in the web interface of Belkin F9K1009 and F9K1010 routers. The exploit is implemented in C (exploit.c) and uses libcurl to send HTTP requests to the router's login page (typically /login.htm). By exploiting improper session validation, it allows an attacker with network access to bypass authentication and gain administrative access to the router. The exploit supports various options, including specifying the router IP, using a cookie file, setting sleep intervals between requests, and making multiple requests in a loop. It also includes logic to fingerprint the router model by analyzing the web interface response. The repository is structured with a single main code file (exploit.c), a README.md with usage instructions and vulnerability details, and a LICENSE file. No hardcoded credentials or backdoors are present; the exploit relies on manipulating HTTP requests to achieve unauthorized access.

byteReaper77Disclosed Aug 8, 2025cnetwork

ACTIVITY FEED

Recent activity

9 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

9 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity9