CVE-2025-28221
Published: 28 March 2025
Summary
CVE-2025-28221 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 15.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents buffer overflows by requiring validation of inputs such as the unvalidated 'time' parameter in POST requests to the set_local_time function.
SI-2 ensures timely flaw remediation, including patching the buffer overflow vulnerability in the Tenda W6_S firmware to eliminate the crash condition.
SI-16 mitigates buffer overflow exploits through memory protections that prevent crashes or unauthorized execution from malformed inputs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the router web server's set_local_time function allows remote unauthenticated exploitation to crash the service, directly mapping to application/system exploitation for endpoint denial of service.
NVD Description
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request.
Deeper analysisAI
CVE-2025-28221 is a buffer overflow vulnerability affecting the Tenda W6_S router running firmware version 1.0.0.4_510. The issue resides in the set_local_time function, which fails to properly validate the 'time' parameter passed via a POST request to the binary, leading to a buffer overflow condition.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no authentication privileges, user interaction, or special conditions, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation results in a denial-of-service condition by crashing the web server, disrupting device availability without impacting confidentiality or integrity.
For mitigation details, refer to the advisory at https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/time.pdf. The vulnerability was published on 2025-03-28.
Details
- CWE(s)