Cyber Resilience

CVE-2025-25678

Critical

Published: 20 February 2025

Published
20 February 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25678 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda I12 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-25678 is a buffer overflow vulnerability (CWE-120) affecting the Tenda i12 router on firmware version V1.0.0.10(3805). The flaw exists in the formSetCfm function, triggered via a specially crafted funcpara1 parameter, and was published on 2025-02-20.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and no change in scope. Remote attackers can thus trigger the buffer overflow without authentication, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or system crashes.

Details on the vulnerability, including a proof-of-concept, are documented in the GitHub repository at https://github.com/jangfan/my-vuln/blob/main/Tenda/i12V1/setcfm.md. No vendor advisories or patches are referenced in the available information.

EU & UK References

Vulnerability details

Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Buffer overflow in unauthenticated public-facing web form (formSetCfm) on router enables remote code execution, directly matching exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25676Same product: Tenda I12
CVE-2026-5609Same product: Tenda I12
CVE-2026-4041Same product: Tenda I12
CVE-2026-5849Same product: Tenda I12
CVE-2026-4043Same product: Tenda I12
CVE-2026-4042Same product: Tenda I12
CVE-2025-29149Same product: Tenda I12
CVE-2025-25679Same product: Tenda I12
CVE-2025-25674Same vendor: Tenda
CVE-2025-29137Same vendor: Tenda

Affected Assets

tenda
i12 firmware
1.0.0.10\(3805\)

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents buffer overflows by validating and sanitizing the funcpara1 parameter in the formSetCfm function.

SI-16 Memory Protection good match
prevent

Implements memory protections such as DEP, ASLR, and stack canaries to mitigate exploitation of the buffer overflow vulnerability.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and patching of the specific buffer overflow flaw in Tenda i12 firmware V1.0.0.10(3805).

References