CVE-2025-25676
Published: 20 February 2025
Summary
CVE-2025-25676 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda I12 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25676 is a buffer overflow vulnerability (CWE-120) affecting the Tenda i12 router running firmware version V1.0.0.10(3805). The issue resides in the formwrlSSIDset function, where the list parameter triggers the overflow. It received a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network by sending a specially crafted request targeting the vulnerable parameter. Successful exploitation could allow arbitrary code execution, potentially granting full control over the affected device, including data theft, modification of configurations, or use as a pivot for further network compromise.
Details on exploitation and potential mitigations are documented in the referenced advisory at https://github.com/jangfan/my-vuln/blob/main/Tenda/i12V1/wifiSSIDget.md. No official patches or vendor advisories were detailed in available information at the time of publication on 2025-02-20.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4499
Vulnerability details
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote unauthenticated buffer overflow in the router's public-facing web interface (formwrlSSIDset) directly enables exploitation via T1190 to achieve arbitrary code execution and full device control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing the buffer overflow by applying firmware patches or updates to eliminate the vulnerability in formwrlSSIDset.
SI-10 mandates information input validation, preventing the buffer overflow by ensuring the 'list' parameter is checked for length and format before processing.
SI-16 provides memory protections such as ASLR and DEP, mitigating arbitrary code execution even if the buffer overflow in the 'list' parameter succeeds.