CVE-2025-25455
Published: 17 April 2025
Summary
CVE-2025-25455 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 25.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AC10 routers running firmware version V4.0si_V16.03.10.20 contain a stack-based buffer overflow vulnerability (CWE-121) in the AdvSetMacMtuWan function triggered through the wanMTU2 parameter. The flaw received a CVSS 7.5 rating reflecting network attack vector, low complexity, and no required authentication or user interaction, with the primary impact being high availability loss.
An unauthenticated remote attacker can send a crafted request to the affected WAN MTU handling endpoint, causing memory corruption that leads to a crash or denial of service. The supplied references consist of public proof-of-concept code demonstrating the stack overflow but do not describe additional impact such as code execution.
No vendor advisory or patch information appears in the referenced materials. The associated EPSS score remains low, with a recorded peak of only 0.0109.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11840
Vulnerability details
Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.