CVE-2014-1635: Belkin N750 router login.cgi buffer overflow via jump parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS v2 score of 10, public exploit code and a very high EPSS percentile makes this an urgent fix for any exposed N750.

What it is

MiniHttpd's login.cgi on the Belkin N750 router contains a buffer overflow reachable through the jump parameter. A long string in that parameter can overwrite memory and let a remote attacker run arbitrary code on the device. The flaw affects firmware before F9K1103_WW_1.10.17m and carries a CVSS v2 score of 10.

Impact

An unauthenticated remote attacker can execute arbitrary code on the router, gaining full control of the device (complete confidentiality, integrity and availability impact per the CVSS vector). That typically means traffic interception, credential capture and use of the router as a foothold into the internal network.

Attack surface

The vector is AV:N/AC:L/Au:N, so the flaw is reachable over the network with no authentication and no user interaction. It sits in the web management interface's login.cgi handler, meaning the router's HTTP service must be reachable by the attacker.

Exploitation

CISA KEV does not list this CVE, but public exploit code exists (Exploit-DB 35184 and an Integrity Labs write-up tagged Exploit), and EPSS gives a 30-day probability of about 0.675 (99.3rd percentile), indicating high likelihood of attempted exploitation.

What to do

• Upgrade the N750 to firmware F9K1103_WW_1.10.17m or later; this is the only complete fix.
• If the router cannot be updated, replace it or disable/block remote access to its web management interface.
• Restrict administrative access to a trusted management VLAN or specific source addresses rather than exposing it to the internet.
• Monitor vendor advisories for the N750, since the device is long past end of support and further fixes are unlikely.

Detection

• Inspect HTTP requests to login.cgi for abnormally long or malformed jump parameter values.
• Alert on crashes, reboots or unexpected process restarts of the router's HTTP service.
• Watch for outbound connections from the router to unknown hosts, which may indicate post-exploitation activity.
• Review router logs for repeated requests to login.cgi from a single external source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.