CVE-2025-1814
Published: 02 March 2025
Summary
CVE-2025-1814 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-1814 is a critical stack-based buffer overflow vulnerability (CVSS 3.1 score of 8.8) in Tenda AC6 router version 15.03.05.16. The flaw affects an unknown functionality within the /goform/WifiExtraSet file, where manipulation of the wpapsk_crypto argument triggers the overflow. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
The vulnerability enables remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), without impacting scope (S:U). Attackers can achieve high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), potentially leading to arbitrary code execution on the device. An exploit has been publicly disclosed and may be used.
Advisories on VulDB (ctiid.298082, id.298082, submit.506532) document the issue, with a proof-of-concept exploit detailed on GitHub at https://github.com/Raining-101/IOT_cve/blob/main/ac6.md_goform_WifiExtraSet.md. The Tenda vendor website is available at https://www.tenda.com.cn/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5867
Vulnerability details
A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is some unknown functionality of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack may…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public web form (/goform/WifiExtraSet) directly enables remote code execution via network-accessible router interface.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the stack-based buffer overflow by requiring timely patching of the vulnerable /goform/WifiExtraSet functionality in Tenda AC6 firmware.
Information input validation prevents the buffer overflow by enforcing bounds checking and sanitization on the wpapsk_crypto argument manipulated remotely.
Memory protection mechanisms like stack canaries and non-executable stacks mitigate exploitation of the stack-based buffer overflow even if input validation fails.