CVE-2025-25454
Published: 17 April 2025
Summary
CVE-2025-25454 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 23.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AC10 V4.0si_V16.03.10.20 contains a stack-based buffer overflow vulnerability (CWE-121) in the AdvSetMacMtuWan function, triggered via the wanSpeed2 parameter. The issue received a CVSS 3.1 score of 7.5 with network attack vector, low complexity, and no required privileges or user interaction, producing a high impact on availability while leaving confidentiality and integrity unaffected.
An unauthenticated attacker with network access can send a specially crafted request to the affected endpoint, causing memory corruption that crashes the device or disrupts WAN connectivity. Public repositories provide proof-of-concept code that reproduces the overflow through direct HTTP interaction with the router's management interface.
The listed references consist solely of exploit disclosures on GitHub and Gist with no accompanying vendor advisory or patch details. The associated EPSS score remains low, moving only from 0.0094 to a peak of 0.0123.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11839
Vulnerability details
Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.