CVE-2025-14655
Published: 14 December 2025
Summary
CVE-2025-14655 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac20 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through vendor firmware patching directly eliminates the stack-based buffer overflow in the formSetRebootTimer function.
Information input validation on the rebootTime argument prevents the manipulation that triggers the stack-based buffer overflow.
Memory protection mechanisms like stack canaries and ASLR mitigate exploitation of the stack-based buffer overflow even if the input flaw exists.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router's httpd web interface (/goform/SetSysAutoRebbotCfg) enables remote exploitation of public-facing application (T1190), exploitation of remote services for code execution (T1210), and application DoS via crash (T1499.004).
NVD Description
A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime results in stack-based buffer overflow. The attack is…
more
possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2025-14655 is a stack-based buffer overflow vulnerability affecting the Tenda AC20 router running firmware version 16.03.08.12. The flaw resides in the formSetRebootTimer function within the /goform/SetSysAutoRebbotCfg file of the httpd component, where manipulation of the rebootTime argument triggers the overflow.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. According to the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation enables high-impact consequences on confidentiality, integrity, and availability, potentially leading to remote code execution.
Advisories and details are documented on VulDB (ctiid.336388, id.336388, submit.712910), with a public exploit released on GitHub at https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN13/AC20_SetSysAutoRebbotCfg.md. The Tenda vendor website (https://www.tenda.com.cn/) provides general product information, but specific patch or mitigation guidance is not detailed in the referenced sources.
The exploit's public availability heightens the risk for unpatched Tenda AC20 devices. The vulnerability is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
Details
- CWE(s)