CVE-2025-13445
Published: 20 November 2025
Summary
CVE-2025-13445 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac21 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs to the /goform/SetIpMacBind endpoint to prevent stack-based buffer overflows from manipulated argument lists.
Implements memory protection mechanisms such as stack canaries or ASLR to mitigate stack-based buffer overflow exploits even if invalid inputs are processed.
Mandates timely remediation of the identified buffer overflow flaw in Tenda AC21 firmware version 16.03.08.16 to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote stack-based buffer overflow in router web interface (/goform/SetIpMacBind) enables exploitation of public-facing application (T1190), exploitation of remote services (T1210), and application exhaustion/DoS (T1499.004) via overflow; PoC available, potentially leading to RCE.
NVD Description
A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has…
more
been published and may be used.
Deeper analysisAI
CVE-2025-13445 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting Tenda AC21 routers on firmware version 16.03.08.16. The issue lies in an unknown component of the /goform/SetIpMacBind file, where manipulation of the argument list triggers the overflow. Published on 2025-11-20, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
An authenticated remote attacker with low privileges can exploit this vulnerability over the network with minimal complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the device. An exploit has been publicly disclosed and is available for use.
Advisories and details are available via VulDB entries (ctiid.333017, id.333017, submit.694066) and the vendor's site at tenda.com.cn. The full exploit PoC is hosted on GitHub at github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN7.md. Practitioners should review these sources for patch availability and mitigation steps.
Details
- CWE(s)