CVE-2025-29030
Published: 14 March 2025
Summary
CVE-2025-29030 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-29030 is a buffer overflow vulnerability (CWE-787) affecting Tenda AC6 routers running version v15.03.05.16. The flaw resides in the formWifiWpsOOB function and was published on 2025-03-14T14:15:18.200. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, and with low complexity. Successful exploitation grants high confidentiality, integrity, and availability impacts, enabling arbitrary code execution, data compromise, or device takeover on affected routers.
Mitigation details are available in the referenced advisory at https://github.com/WhereisDoujo/CVE/issues/3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6430
Vulnerability details
Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The buffer overflow in the router's web form (/goform/WifiWpsOOB) enables remote exploitation of a public-facing application via crafted HTTP POST requests, potentially leading to code execution or denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow vulnerability in the formWifiWpsOOB function through timely application of vendor firmware patches.
Implements memory protections such as address space layout randomization and stack canaries to mitigate exploitation of the buffer overflow for arbitrary code execution.
Requires validation of inputs to the formWifiWpsOOB function to reject oversized or malformed data that could trigger the buffer overflow.