CVE-2025-11549
Published: 09 October 2025
Summary
CVE-2025-11549 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda W12 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11549 is a stack-based buffer overflow vulnerability in the Tenda W12 router running firmware version 3.0.0.6(3948). The issue resides in the wifiMacFilterSet function within the /goform/modules file of the HTTP Request Handler component. By manipulating the 'mac' argument in a crafted HTTP request, an attacker triggers the overflow, as associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The attack can be conducted remotely over the network with low complexity and requires low privileges (PR:L), such as those of an authenticated user on the device. No user interaction is needed, and exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data theft, or device compromise.
Advisories from VulDB detail the vulnerability and note that a proof-of-concept exploit has been publicly disclosed on GitHub, making it readily usable by attackers. The vendor's website (tenda.com.cn) is referenced, but no specific patches or mitigations are outlined in available details; security practitioners should check for firmware updates directly from Tenda.
Notable context includes the public availability of the exploit, increasing the risk of real-world abuse against unpatched Tenda W12 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33407
Vulnerability details
A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. The attack is…
more
possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote stack-based buffer overflow in the Tenda W12 router's HTTP handler (wifiMacFilterSet) enables arbitrary code execution via crafted requests to a public-facing web interface.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely identification, reporting, and correction of the stack-based buffer overflow flaw through firmware patching.
Requires validation of the 'mac' argument in HTTP requests to the wifiMacFilterSet function, preventing the buffer overflow exploitation.
Implements memory safeguards like stack canaries or DEP to protect against unauthorized code execution from the stack-based buffer overflow.