CVE-2025-0848
Published: 30 January 2025
Summary
CVE-2025-0848 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda A18 Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents stack-based buffer overflows by checking the length and format of the wpapsk_crypto5g argument in HTTP POST requests.
Memory protection mechanisms such as stack canaries and address space layout randomization mitigate exploitation of the stack buffer overflow in the SetCmdlineRun function.
Flaw remediation requires patching the specific buffer overflow vulnerability in Tenda A18 firmware versions up to 15.13.07.09 to eliminate the root cause.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in HTTP POST handler (/goform/SetCmdlineRun) enables remote code execution without authentication, facilitating exploitation of public-facing applications and remote services on the router.
NVD Description
A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapsk_crypto5g leads…
more
to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0848 is a stack-based buffer overflow vulnerability affecting Tenda A18 router firmware versions up to 15.13.07.09. The issue resides in the SetCmdlineRun function within the /goform/SetCmdlineRun component of the HTTP POST request handler, where manipulation of the wpapsk_crypto5g argument triggers the overflow. Published on 2025-01-30, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is mapped to CWEs 119, 121, and 787.
The vulnerability is exploitable remotely by attackers with network access who possess low privileges, such as an authenticated web interface user, under low complexity conditions and without requiring user interaction. Exploitation results in high availability impact, enabling denial-of-service effects like device crashes, with no compromise to confidentiality or integrity.
VulDB advisories (ctiid.294011, id.294011, submit.485802) document the vulnerability details, while a GitHub repository (alc9700jmo/CVE/issues/9) discloses a public proof-of-concept exploit. The Tenda website provides a reference for vendor-specific guidance.
The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)