CVE-2025-25674
Published: 20 February 2025
Summary
CVE-2025-25674 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25674 is a buffer overflow vulnerability (CWE-120) in the Tenda AC10 V1.0 router running firmware version V15.03.06.23. The flaw occurs in the form_fast_setting_wifi_set function when processing the 'ssid' parameter, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Published on 2025-02-20, it exposes the device to potential remote exploitation due to inadequate bounds checking on user-supplied input.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, likely enabling arbitrary code execution, device takeover, or denial of service.
The primary reference at https://github.com/jangfan/my-vuln/blob/main/Tenda/AC10V1/fast_setting_wifi_set.md details the vulnerability, including the affected endpoint and parameter. No official vendor patches or mitigation advisories are specified in available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4504
Vulnerability details
Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote unauthenticated buffer overflow in the router's public web form (form_fast_setting_wifi_set) directly enables exploitation of a public-facing application for RCE or DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces bounds checking and validation on user-supplied inputs like the 'ssid' parameter to prevent buffer overflows in the form_fast_setting_wifi_set function.
Requires timely identification, reporting, and patching of flaws such as this buffer overflow in router firmware to eliminate the vulnerability.
Implements memory protections like address space layout randomization or stack guards to mitigate arbitrary code execution from buffer overflows even if input validation fails.