CVE-2025-28220
Published: 28 March 2025
Summary
CVE-2025-28220 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Tenda W6_S v1.0.0.4_510 contains a buffer overflow vulnerability in the setcfm function, tracked as CVE-2025-28220 and assigned CWE-120. The flaw resides in the device's web server binary and is triggered when the funcpara1 parameter is supplied in a POST request, allowing an unauthenticated remote attacker to supply malformed input that corrupts memory and terminates the web server process. The issue carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and high availability impact with no confidentiality or integrity consequences.
An attacker with network access to the device can send a crafted POST request containing an oversized or malformed funcpara1 value directly to the setcfm endpoint. Successful exploitation results only in a denial-of-service condition that crashes the web server; no further code execution or data access has been demonstrated in the available details.
The single reference is a technical write-up hosted on GitHub that reproduces the crash but provides no vendor advisory, firmware update, or mitigation guidance. The associated EPSS score remains low, moving only from 0.0197 to a peak of 0.0268, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8617
Vulnerability details
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web server function allows remote unauthenticated exploitation causing application crash, directly enabling Endpoint Denial of Service via Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs such as the funcpara1 parameter in POST requests to prevent buffer overflows in the setcfm function.
Implements memory protection mechanisms like stack canaries and non-executable memory to mitigate buffer overflow exploits leading to crashes.
Mandates timely identification, reporting, and remediation of flaws like this buffer overflow to patch the vulnerable firmware.