Cyber Resilience

CVE-2025-22916

CriticalPublic PoC

Published: 16 January 2025

Published
16 January 2025
Modified
09 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0052 67.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22916 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Edimax Re11S Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-22916 is a stack-based buffer overflow vulnerability (CWE-120) affecting RE11S version 1.11. The flaw occurs in the formPPPoESetup function when processing the pppUserName parameter, allowing excessive data to overflow the stack. This critical issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating severe potential impact from remote exploitation.

An unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted request targeting the pppUserName parameter, the attacker can trigger the stack overflow, potentially leading to arbitrary code execution, denial of service, or full compromise of the affected device, with high impacts on confidentiality, integrity, and availability.

References include the vendor site at http://re11s.com and https://www.edimax.com/edimax/global/, along with a GitHub proof-of-concept at https://github.com/xyqer1/RE11S_1.11-formPPPoESetup-StackOverflow. No specific mitigation or patch details are detailed in the available information.

EU & UK References

Vulnerability details

RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Stack-based buffer overflow in formPPPoESetup (web form for PPPoE) allows unauthenticated remote RCE via crafted pppUserName parameter, directly enabling T1190 for initial access to public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-22904Same product: Edimax Re11S
CVE-2025-22913Same product: Edimax Re11S
CVE-2025-22907Same product: Edimax Re11S
CVE-2025-22905Same product: Edimax Re11S
CVE-2025-22906Same product: Edimax Re11S
CVE-2025-22912Same product: Edimax Re11S
CVE-2024-48420Same vendor: Edimax
CVE-2024-48416Same vendor: Edimax
CVE-2020-37125Same vendor: Edimax
CVE-2021-47854Shared CWE-120

Affected Assets

edimax
re11s firmware
1.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the stack overflow flaw in RE11S v1.11 formPPPoESetup function.

SI-10 Information Input Validation good match
prevent

Mandates validation of the pppUserName parameter to block excessive input causing the stack-based buffer overflow.

SI-16 Memory Protection good match
prevent

Implements memory safeguards like stack canaries and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.

References