CVE-2025-29100
Published: 24 March 2025
Summary
CVE-2025-29100 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ac8 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-29100 is a stack-based buffer overflow vulnerability (CWE-121) affecting the Tenda AC8 router on firmware version V16.03.34.06. The flaw resides in the fromSetRouteStatic function and is triggered via the "list" parameter. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network reachability, low complexity, lack of required privileges or user interaction, and potential for high-impact disruption across confidentiality, integrity, and availability.
A remote, unauthenticated attacker can exploit this vulnerability over the network by sending a maliciously crafted request to the vulnerable function, causing a buffer overflow. Exploitation could result in arbitrary code execution on the device, enabling full compromise, such as persistent access, data theft, or service disruption.
References point to GitHub repositories by researcher Raining-101, including a gist and Markdown files detailing the Tenda AC8 V16.03.34.06 stack overflow in fromSetRouteStatic, with proof-of-concept code demonstrating the issue. No vendor advisories or patches are mentioned in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8018
Vulnerability details
Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote unauthenticated stack-based buffer overflow in the public-facing fromSetRouteStatic web function directly enables T1190 (Exploit Public-Facing Application) for initial access and arbitrary code execution on the router.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the buffer overflow by validating the 'list' parameter in the fromSetRouteStatic function to reject malformed or oversized inputs.
Implements memory protections such as DEP and ASLR to block arbitrary code execution even if the stack-based buffer overflow occurs.
Requires timely flaw remediation through firmware patching to eliminate the specific buffer overflow vulnerability in Tenda AC8 V16.03.34.06.