CVE-2009-20009

Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/belkin_bulldog.rb
https://s3.belkin.com/support/dl/bulldogwindows.pdf
https://www.exploit-db.com/exploits/8173
https://www.fortiguard.com/encyclopedia/ips/17325/belkin-bulldog-plus-web-services-buffer-overflow
https://www.vulncheck.com/advisories/belkin-bulldog-plus-web-service-buffer-overflow

Configurations

No configuration.

History

01 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Belkin Bulldog Plus versión 4.0.2 compilación 1219 contiene una vulnerabilidad de desbordamiento de búfer basado en pila en su gestor de autenticación de servicio web. Cuando se envía una solicitud HTTP especialmente diseñada con una cabecera de autorización sobredimensionada, la aplicación no valida correctamente la longitud de la entrada antes de copiarla en un búfer de tamaño fijo, lo que resulta en corrupción de memoria y potencial ejecución remota de código. La explotación requiere acceso a la red y no requiere autenticación previa.

Information

Published : 2025-08-30 14:15

Updated : 2026-10-01 23:10

NVD link : CVE-2009-20009

Mitre link : CVE-2009-20009

CVE.ORG link : CVE-2009-20009

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2009-20009", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2009-20009", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-02T20:46:51.105266Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Belkin International, Inc.", "modules": ["HTTP authentication handler"], "product": "Bulldog Plus UPS Monitoring Software", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.0.2 build 1219"}], "defaultStatus": "unaffected"}]}], "published": "2025-08-30T14:15:34.153", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/belkin_bulldog.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://s3.belkin.com/support/dl/bulldogwindows.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/8173", "source": "disclosure@vulncheck.com"}, {"url": "https://www.fortiguard.com/encyclopedia/ips/17325/belkin-bulldog-plus-web-services-buffer-overflow", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/belkin-bulldog-plus-web-service-buffer-overflow", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication."}, {"lang": "es", "value": "Belkin Bulldog Plus versi\u00f3n 4.0.2 compilaci\u00f3n 1219 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en pila en su gestor de autenticaci\u00f3n de servicio web. Cuando se env\u00eda una solicitud HTTP especialmente dise\u00f1ada con una cabecera de autorizaci\u00f3n sobredimensionada, la aplicaci\u00f3n no valida correctamente la longitud de la entrada antes de copiarla en un b\u00fafer de tama\u00f1o fijo, lo que resulta en corrupci\u00f3n de memoria y potencial ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n requiere acceso a la red y no requiere autenticaci\u00f3n previa."}], "lastModified": "2026-10-01T23:10:00.233", "sourceIdentifier": "disclosure@vulncheck.com"}