Buffer overflow in Belkin International, Inc. Bulldog Plus Ups Monitoring Software
CVE-2009-20009
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.013 (68.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
- www.exploit-db.com/exploits/8173 (exploit)
- www.fortiguard.com/encyclopedia/ips/17325/belkin-bulldog-plus-web-services-buff… (third-party-advisory)
- s3.belkin.com/support/dl/bulldogwindows.pdf (product)
- www.vulncheck.com/advisories/belkin-bulldog-plus-web-service-buffer-overflow (third-party-advisory)
Frequently asked questions
- What is CVE-2009-20009?
- CVE-2009-20009 is a vulnerability in Belkin International, Inc. Bulldog Plus Ups Monitoring Software, classified under Stack-based Buffer Overflow. Published 2025-08-30.
- Is CVE-2009-20009 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.