CVE-2025-25343
Published: 12 February 2025
Summary
CVE-2025-25343 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the buffer overflow vulnerability by identifying, reporting, and patching the affected formexeCommand function in the firmware.
Information input validation prevents buffer overflows by checking and sanitizing inputs to the formexeCommand function before processing.
Memory protection mechanisms like ASLR and stack canaries mitigate the impact of buffer overflow exploitation in the firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the formexeCommand web function via cmdinput parameter enables remote exploitation of a public-facing application (T1190), exploitation of remote services for potential RCE (T1210), and application denial of service via crash (T1499.004).
NVD Description
Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.
Deeper analysisAI
CVE-2025-25343 is a buffer overflow vulnerability (CWE-120) present in the formexeCommand function of the Tenda AC6 V15.03.05.16 firmware. Published on 2025-02-12, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
Remote attackers can exploit this vulnerability over the network with low complexity, without requiring authentication privileges or user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution and full control over the affected router.
Mitigation details are available in the referenced advisory at https://github.com/wy876/cve/issues/4.
Details
- CWE(s)