CVE-2025-29135
Published: 24 March 2025
Summary
CVE-2025-29135 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ac7 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the security parameter in formWifiBasicSet to directly prevent stack-based buffer overflows from oversized or malformed inputs.
Implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of the stack overflow for arbitrary code execution.
Mandates timely identification, reporting, and patching of the buffer overflow flaw in Tenda AC7 firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router web form handling function (formWifiBasicSet) enables remote unauthenticated arbitrary code execution on a public-facing network device.
NVD Description
A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using the security parameter of the formWifiBasicSet function.
Deeper analysisAI
CVE-2025-29135 is a stack-based buffer overflow vulnerability (CWE-121) in the Tenda AC7 router running firmware version V15.03.06.44. The flaw occurs in the formWifiBasicSet function, where the security parameter can be abused to trigger a stack overflow, potentially allowing arbitrary code execution. Published on March 24, 2025, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
The vulnerability can be exploited by a remote attacker over the network with no required privileges, low complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N). Successful exploitation grants high-impact confidentiality, integrity, and availability consequences (C:H/I:H/A:H) within the unchanged scope (S:U), enabling the attacker to execute arbitrary code on the affected device.
Proof-of-concept details are documented in public GitHub repositories by Raining-101, including a Gist at https://gist.github.com/Raining-101/1651dd3901efdbb38d94a156a54bbc62 and Markdown files at https://github.com/Raining-101/IOT_cve/blob/main/a7_formWifiBasic_Setsecurity_stackoverflow.md. No vendor advisories or patches are referenced in the available information.
Details
- CWE(s)