CVE-2025-11120
Published: 28 September 2025
Summary
CVE-2025-11120 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-11120 is a buffer overflow vulnerability, associated with CWE-119 and CWE-120, affecting the formSetServerConfig function in the /goform/SetServerConfig file of Tenda AC8 router firmware version 16.03.34.06. Published on 2025-09-28, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability enables remote exploitation over the network with low attack complexity, requiring only low privileges such as an authenticated user account and no user interaction. Attackers can manipulate inputs to trigger the buffer overflow, potentially achieving high confidentiality, integrity, and availability impacts, including arbitrary code execution on the affected device.
Advisories on VulDB (ctiid.326201, id.326201, submit.664065) document the issue and note that a public exploit is available via a GitHub repository (alc9700jmo/CVE/issues/19). The Tenda vendor website (tenda.com.cn) is referenced, though specific patch or mitigation details are not outlined in the provided sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31476
Vulnerability details
A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made…
more
available to the public and could be exploited.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web form (/goform/SetServerConfig) directly enables remote authenticated RCE on a network device, mapping to exploitation of public-facing apps and privilege escalation from low-priv account.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow vulnerability by applying vendor patches or firmware updates to the affected Tenda AC8 formSetServerConfig function.
Information input validation prevents buffer overflows by ensuring inputs to the /goform/SetServerConfig endpoint are properly checked for length and format before processing.
Memory protection mechanisms like address space layout randomization and non-executable stacks mitigate exploitation of the buffer overflow even if invalid inputs are processed.