CVE-2025-0566
Published: 19 January 2025
Summary
CVE-2025-0566 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac15 Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A critical stack-based buffer overflow vulnerability, tracked as CVE-2025-0566, affects the Tenda AC15 router running firmware version 15.13.07.13. It resides in the formSetDevNetName function within the /goform/SetDevNetName endpoint, where improper handling of the mac argument allows an out-of-bounds write. The flaw is reachable over the network and is associated with CWE-119, CWE-121, and CWE-787.
An authenticated remote attacker can supply a crafted mac value to trigger the overflow, achieving arbitrary code execution or a full device crash with impacts rated high for confidentiality, integrity, and availability under CVSS 4.0. Public exploit code has already been disclosed, enabling straightforward weaponization against exposed devices.
The provided references point to disclosure records on VulDB and a vendor site but contain no details on official patches or configuration mitigations. The associated EPSS score remains flat at 0.1360 with no material increase observed since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1763
Vulnerability details
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing web management interface (/goform/SetDevNetName) directly enables remote exploitation for arbitrary code execution (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the 'mac' argument in the /goform/SetDevNetName endpoint to prevent stack-based buffer overflow from malformed input.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.
Mandates timely remediation of the known buffer overflow flaw in Tenda AC15 firmware version 15.13.07.13 via patching.