CVE-2025-28220
Published: 28 March 2025
Summary
CVE-2025-28220 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 14.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs such as the funcpara1 parameter in POST requests to prevent buffer overflows in the setcfm function.
Implements memory protection mechanisms like stack canaries and non-executable memory to mitigate buffer overflow exploits leading to crashes.
Mandates timely identification, reporting, and remediation of flaws like this buffer overflow to patch the vulnerable firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web server function allows remote unauthenticated exploitation causing application crash, directly enabling Endpoint Denial of Service via Application or System Exploitation.
NVD Description
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
Deeper analysisAI
CVE-2025-28220 is a buffer overflow vulnerability (CWE-120) affecting the Tenda W6_S router firmware version 1.0.0.4_510, specifically in the setcfm function. Remote attackers can trigger this flaw by sending a POST request to the binary with a specially crafted value in the funcpara1 parameter, leading to a web server crash. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its high severity due to the potential for denial-of-service.
Any unauthenticated remote attacker with network access to the device can exploit this vulnerability with low complexity and no user interaction required. Exploitation involves crafting and transmitting the malicious POST request, resulting in the web server's crash and disruption of services, though no confidentiality or integrity impacts are possible.
A technical analysis of the vulnerability is documented in the reference at https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/setcfm.pdf, published on 2025-03-28. No patch or mitigation details are specified in the CVE description.
Details
- CWE(s)