CVE-2025-1895
Published: 04 March 2025
Summary
CVE-2025-1895 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Tx3 Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability in /goform/setMacFilterCfg by requiring identification, reporting, and correction of the specific flaw via firmware patching.
Prevents exploitation by enforcing validation of the deviceList argument to block malformed inputs that trigger the buffer overflow.
Mitigates successful buffer overflow attacks through memory protections such as non-executable memory regions and stack guards, reducing availability impact.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web form (/goform/setMacFilterCfg) enables remote exploitation of internet-facing router firmware for DoS via crash (T1190 for public-facing app exploitation; T1499.004 for application/system exploitation causing availability impact).
NVD Description
A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to buffer overflow. It is possible to initiate the attack remotely. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1895 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda TX3 firmware version 16.03.13.11_multi. The flaw affects an unknown part of the /goform/setMacFilterCfg file, where manipulation of the deviceList argument triggers the overflow. Published on 2025-03-04, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation results in high availability impact, such as device crashes or denial of service, without compromising confidentiality or integrity.
VulDB advisories (ctiid.298413, id.298413, submit.506601) document the issue, and a proof-of-concept exploit is publicly disclosed in a GitHub repository (tenda_tx3_bof_1.pdf). The Tenda vendor website provides relevant resources for further details on patches or mitigations.
Details
- CWE(s)