CVE-2025-11091
Published: 28 September 2025
Summary
CVE-2025-11091 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac21 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely application of firmware patches to remediate the buffer overflow vulnerability in the Tenda AC21's SetStaticRouteCfg CGI endpoint.
Mandates validation of inputs to the sscanf function in /goform/SetStaticRouteCfg to block malformed argument lists that trigger the buffer overflow.
Implements memory protections such as stack guards or ASLR to mitigate exploitation of the buffer overflow leading to arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public CGI endpoint (/goform/SetStaticRouteCfg) on network device directly enables remote code execution via exploitation of a public-facing application.
NVD Description
A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely.…
more
The exploit has been released to the public and may be exploited.
Deeper analysisAI
CVE-2025-11091 is a buffer overflow vulnerability in Tenda AC21 routers running firmware versions up to 16.03.08.16. The issue affects the sscanf function within the /goform/SetStaticRouteCfg CGI endpoint, where manipulation of the argument list triggers the overflow. This flaw, linked to CWE-119 and CWE-120, was published on 2025-09-28 and carries a CVSS v3.1 base score of 8.8.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to arbitrary code execution on the device.
Advisories and details are available via VulDB entries (ctiid.326173, id.326173, submit.661806) and the Tenda vendor site (tenda.com.cn). A proof-of-concept exploit has been publicly released on GitHub (maximdevere/CVE2/issues/2).
The public availability of the exploit indicates potential for active exploitation.
Details
- CWE(s)