CVE-2025-29137
Published: 19 March 2025
Summary
CVE-2025-29137 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac7 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability by identifying, testing, and installing firmware updates for the affected Tenda AC7 V15.03.06.44.
Requires validation of the timeZone parameter in the form_fast_setting_wifi_set function to prevent buffer overflows from malformed inputs.
Implements memory safeguards such as ASLR and DEP to protect against remote code execution resulting from the buffer overflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web form handler (form_fast_setting_wifi_set) on router enables unauthenticated remote exploitation for RCE.
NVD Description
Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can cause RCE.
Deeper analysisAI
CVE-2025-29137 is a buffer overflow vulnerability (CWE-120) affecting the Tenda AC7 V1.0 router on firmware version V15.03.06.44. The flaw occurs in the form_fast_setting_wifi_set function due to improper handling of the timeZone parameter, which can trigger a buffer overflow and lead to remote code execution (RCE). Published on 2025-03-19, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
An unauthenticated attacker with network access can exploit this vulnerability remotely by sending a specially crafted request targeting the timeZone parameter. The low attack complexity and lack of required privileges or user interaction enable straightforward exploitation, resulting in high-impact compromise of confidentiality, integrity, and availability on the device, including full RCE capabilities.
Mitigation details and technical analysis are available in the referenced advisory at https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac7form_fast_setting_wifi_set%20timeZone.md.
Details
- CWE(s)