CVE-2025-29029
Published: 14 March 2025
Summary
CVE-2025-29029 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability in the formSetSpeedWan function of Tenda AC6 v15.03.05.16 through timely flaw remediation including firmware patching.
Enforces validation of inputs to the formSetSpeedWan function to prevent out-of-bounds writes from unauthenticated remote attackers.
Implements memory protections such as non-executable stacks and ASLR to mitigate arbitrary code execution from exploitation of the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the router's public-facing web interface (formSetSpeedWan) enables exploitation for initial access (T1190) and denial of service via application exploitation leading to crash (T1499.004).
NVD Description
Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.
Deeper analysisAI
CVE-2025-29029 is a buffer overflow vulnerability (CWE-787) affecting Tenda AC6 routers running version v15.03.05.16. The issue resides in the formSetSpeedWan function, which can be triggered to cause an out-of-bounds write. Published on 2025-03-14, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical severity.
An unauthenticated remote attacker with network access to the device can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation enables high-impact consequences across confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the router.
Mitigation details are available in the referenced advisory at https://github.com/WhereisDoujo/CVE/issues/2.
Details
- CWE(s)