CVE-2025-25897
Published: 13 February 2025
Summary
CVE-2025-25897 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tp-Link Tl-Wr841Nd Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow exploitation by validating the crafted 'ip' parameter input at the vulnerable /userRpm/WanStaticIpV6CfgRpm.htm web endpoint.
Implements memory protections like stack canaries and address space randomization to block buffer overflow crashes causing DoS in the router.
Protects against or limits the denial-of-service impact from remote unauthenticated buffer overflow attacks on the router's web interface.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated web management endpoint directly enables remote exploitation of a public-facing network device application, resulting in DoS.
NVD Description
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Deeper analysisAI
CVE-2025-25897 is a buffer overflow vulnerability (CWE-787) discovered in TP-Link TL-WR841ND V11 routers. It affects the handling of the 'ip' parameter in the /userRpm/WanStaticIpV6CfgRpm.htm web endpoint. Published on 2025-02-13, the issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction. By sending a crafted packet to the vulnerable endpoint, they trigger the buffer overflow, causing a Denial of Service (DoS) that disrupts the router's functionality.
Additional technical details are available in the referenced document at https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_3.pdf. No vendor advisories or patches are specified in the available information.
Details
- CWE(s)