Cyber Posture

CVE-2025-22907

CriticalPublic PoC

Published: 16 January 2025

Published
16 January 2025
Modified
09 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 58.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22907 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validation of inputs like the selSSID parameter to prevent buffer overflows by checking size and format before processing in formWlSiteSurvey.

prevent

SI-2 mandates timely identification, reporting, and correction of flaws such as the stack overflow in RE11S v1.11, directly addressing the vulnerability through patching.

prevent

SI-16 implements memory protections like stack canaries or ASLR to prevent arbitrary code execution from stack overflows triggered by the selSSID parameter.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The unauthenticated remote stack overflow in a web form handler (formWlSiteSurvey) directly enables exploitation of a public-facing application for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.

Deeper analysisAI

CVE-2025-22907 is a stack overflow vulnerability affecting RE11S version 1.11, specifically via the selSSID parameter in the formWlSiteSurvey function. Classified under CWE-120 (Buffer Copy without Checking Size of Input), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation could lead to high confidentiality, integrity, and availability impacts, likely enabling arbitrary code execution through the stack overflow.

References include the RE11S site at http://re11s.com, a GitHub proof-of-concept repository at https://github.com/xyqer1/RE11S_1.11-formWlSiteSurvey-StackOverflow, and the Edimax global site at https://www.edimax.com/edimax/global/. No specific mitigation or patch details are detailed in the CVE description.

Details

CWE(s)

Affected Products

edimax
re11s firmware
1.11

CVEs Like This One

CVE-2025-22916Same product: Edimax Re11S
CVE-2025-22904Same product: Edimax Re11S
CVE-2025-22913Same product: Edimax Re11S
CVE-2025-22906Same product: Edimax Re11S
CVE-2025-22905Same product: Edimax Re11S
CVE-2025-22912Same product: Edimax Re11S
CVE-2024-48420Same vendor: Edimax
CVE-2024-48416Same vendor: Edimax
CVE-2020-37125Same vendor: Edimax
CVE-2024-57482Shared CWE-120

References