CVE-2025-25898
Published: 13 February 2025
Summary
CVE-2025-25898 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tp-Link Tl-Wr841Nd Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the pskSecret parameter input to prevent buffer overflow exploitation from crafted packets.
Remediates the specific buffer overflow flaw in the router's handling of the pskSecret parameter through timely patching or updates.
Protects against the denial-of-service condition caused by the buffer overflow crash via DoS mitigation techniques like rate limiting.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public router web UI endpoint directly enables remote unauthenticated exploitation for DoS via application/system exploitation.
NVD Description
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Deeper analysisAI
CVE-2025-25898, published on 2025-02-13, is a buffer overflow vulnerability (CWE-787) affecting the TP-Link TL-WR841ND V11 router. The issue resides in the handling of the pskSecret parameter at the /userRpm/WlanSecurityRpm.htm endpoint, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote, unauthenticated attackers can exploit this vulnerability with low attack complexity and no user interaction by sending a crafted packet to the affected endpoint. Successful exploitation leads to a Denial of Service condition, disrupting the router's availability without impacting confidentiality or integrity.
A technical report detailing the vulnerability is available at https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_1.pdf.
Details
- CWE(s)