CVE-2025-22946
Published: 10 January 2025
Summary
CVE-2025-22946 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Tenda AC9 v1.0 running firmware version 15.03.05.19 contains a stack-based buffer overflow in the /goform/SetOnlineDevName endpoint, tracked as CVE-2025-22946. The flaw, classified under CWE-120, arises from unsafe handling of device name input and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated attacker can send a crafted HTTP request to the affected endpoint and trigger the overflow to execute arbitrary code on the device. Successful exploitation grants full control over the router, enabling actions such as traffic interception, persistence, or lateral movement within the local network.
The single public reference details the vulnerability through static analysis of the formSetDeviceName sprintf call but provides no vendor advisory, patch information, or mitigation guidance. The associated EPSS score remains low, with a current value of 0.0326 and a peak of 0.0460, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3051
Vulnerability details
Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated RCE via crafted HTTP request to public web endpoint on network device (buffer overflow in /goform/SetOnlineDevName).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of untrusted inputs to the /goform/SetOnlineDevName web endpoint, directly preventing stack overflows from specially crafted HTTP requests.
Implements memory protection mechanisms such as stack canaries, ASLR, and DEP to mitigate stack overflow exploits leading to arbitrary code execution.
Requires timely remediation of identified flaws like the unsafe sprintf usage in the router firmware to eliminate the vulnerability.