CVE-2025-0566
Published: 19 January 2025
Summary
CVE-2025-0566 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac15 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the 'mac' argument in the /goform/SetDevNetName endpoint to prevent stack-based buffer overflow from malformed input.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.
Mandates timely remediation of the known buffer overflow flaw in Tenda AC15 firmware version 15.13.07.13 via patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing web management interface (/goform/SetDevNetName) directly enables remote exploitation for arbitrary code execution (T1190).
NVD Description
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0566 is a critical stack-based buffer overflow vulnerability affecting the Tenda AC15 router on firmware version 15.13.07.13. The issue lies in the formSetDevNetName function processed via the /goform/SetDevNetName endpoint, where manipulation of the "mac" argument triggers the overflow. Classified under CWEs-119, CWE-121, and CWE-787, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-19.
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Exploitation leads to high confidentiality, integrity, and availability impacts, potentially enabling arbitrary code execution on the device through the buffer overflow.
Advisories and further details are available via VulDB entries such as https://vuldb.com/?ctiid.292527 and https://vuldb.com/?id.292527, along with the vendor site at https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be actively used.
Details
- CWE(s)