CVE-2025-12611
Published: 03 November 2025
Summary
CVE-2025-12611 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac21 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the buffer overflow flaw in the formSetPPTPServer function via firmware patching.
Prevents the buffer overflow by enforcing validity checks on the manipulated startIp argument in /goform/SetPptpServerCfg.
Implements memory safeguards like ASLR, stack canaries, and non-executable stacks to block exploitation of the buffer overflow even if triggered.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in router web management interface (/goform/SetPptpServerCfg) enables exploitation of public-facing application for RCE (T1190) and application crash/DoS (T1499.004), with public PoC available.
NVD Description
A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available…
more
and might be used.
Deeper analysisAI
CVE-2025-12611 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda AC21 routers running firmware version 16.03.08.16. The flaw affects the formSetPPTPServer function in the /goform/SetPptpServerCfg file, where manipulation of the startIp argument triggers the overflow.
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring network access, low complexity, and no user interaction, as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing full compromise of the affected device. A public exploit is available and might be used.
Advisories and additional details are available via references including VulDB entries (ctiid.330906, id.330906, submit.678491), a GitHub issue at LX-LX88/cve/issues/10, and the Tenda website at tenda.com.cn. Practitioners should consult these for any patch availability or mitigation guidance.
Details
- CWE(s)