CVE-2025-22946
Published: 10 January 2025
Summary
CVE-2025-22946 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of untrusted inputs to the /goform/SetOnlineDevName web endpoint, directly preventing stack overflows from specially crafted HTTP requests.
Implements memory protection mechanisms such as stack canaries, ASLR, and DEP to mitigate stack overflow exploits leading to arbitrary code execution.
Requires timely remediation of identified flaws like the unsafe sprintf usage in the router firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated RCE via crafted HTTP request to public web endpoint on network device (buffer overflow in /goform/SetOnlineDevName).
NVD Description
Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-22946 is a stack overflow vulnerability in the Tenda AC9 v1.0 router running firmware version v15.03.05.19. The flaw occurs in the /goform/SetOnlineDevName web endpoint due to improper input handling, such as unsafe use of sprintf, which can lead to remote arbitrary code execution. Published on 2025-01-10, it is associated with CWE-120 (Buffer Copy without Checking Size of Input) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Remote attackers with network access can exploit this vulnerability without authentication or user interaction. By sending a specially crafted HTTP request to the /goform/SetOnlineDevName endpoint, an attacker triggers the stack overflow, enabling arbitrary code execution on the device. Successful exploitation grants full control over the router, potentially allowing attackers to pivot within the network, steal data, or disrupt services.
Mitigation details and technical analysis are available in the referenced advisory at https://noisy-caravel-a9a.notion.site/Tenda_AC9V1-0_V15-03-05-19_formSetDeviceName_sprintf_bof-16f898c94eac8057afcbceb63fda7d24. No vendor patches or additional official advisories are specified in the CVE data.
Details
- CWE(s)