CVE-2025-22913
Published: 16 January 2025
Summary
CVE-2025-22913 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the rootAPmac parameter input to prevent stack overflow exploitation in formStaDrvSetup.
Implements memory protections such as stack guards or non-executable stacks to mitigate arbitrary code execution from the stack overflow.
Mandates timely remediation of the known stack overflow flaw in RE11S v1.11 via patching or upgrades.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote stack overflow in a web form (formStaDrvSetup) on a network-exposed device directly enables arbitrary code execution via exploitation of a public-facing application.
NVD Description
RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.
Deeper analysisAI
CVE-2025-22913 is a stack overflow vulnerability (CWE-120) in RE11S version 1.11, triggered by the rootAPmac parameter in the formStaDrvSetup function. Published on 2025-01-16, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impact across confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and without requiring user interaction. Exploitation of the stack overflow could enable arbitrary code execution, system crashes, or full compromise of the affected RE11S component.
References include a GitHub repository at https://github.com/xyqer1/RE11S_1.11-formStaDrvSetup-StackOverflow containing exploit details, and the vendor site at https://www.edimax.com/edimax/global/ for potential advisories or patches.
Details
- CWE(s)