CVE-2025-22907
Published: 16 January 2025
Summary
CVE-2025-22907 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of inputs like the selSSID parameter to prevent buffer overflows by checking size and format before processing in formWlSiteSurvey.
SI-2 mandates timely identification, reporting, and correction of flaws such as the stack overflow in RE11S v1.11, directly addressing the vulnerability through patching.
SI-16 implements memory protections like stack canaries or ASLR to prevent arbitrary code execution from stack overflows triggered by the selSSID parameter.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote stack overflow in a web form handler (formWlSiteSurvey) directly enables exploitation of a public-facing application for arbitrary code execution.
NVD Description
RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.
Deeper analysisAI
CVE-2025-22907 is a stack overflow vulnerability affecting RE11S version 1.11, specifically via the selSSID parameter in the formWlSiteSurvey function. Classified under CWE-120 (Buffer Copy without Checking Size of Input), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation could lead to high confidentiality, integrity, and availability impacts, likely enabling arbitrary code execution through the stack overflow.
References include the RE11S site at http://re11s.com, a GitHub proof-of-concept repository at https://github.com/xyqer1/RE11S_1.11-formWlSiteSurvey-StackOverflow, and the Edimax global site at https://www.edimax.com/edimax/global/. No specific mitigation or patch details are detailed in the CVE description.
Details
- CWE(s)