CVE-2025-29384
Published: 14 March 2025
Summary
CVE-2025-29384 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the wanMTU parameter to prevent stack overflows from specially crafted oversized inputs in the /goform/AdvSetMacMtuWan endpoint.
Implements stack canaries, ASLR, and DEP to protect against exploitation of the stack overflow vulnerability leading to arbitrary code execution.
Requires timely identification, reporting, and patching of the stack overflow flaw in Tenda AC9 firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow vulnerability in the router's web interface (/goform/AdvSetMacMtuWan) enables remote arbitrary code execution, directly mapping to exploitation of a public-facing application.
NVD Description
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-29384 is a stack overflow vulnerability (CWE-787) affecting the Tenda AC9 v1.0 router on firmware version V15.03.05.14_multi. The issue resides in the wanMTU parameter handled by the /goform/AdvSetMacMtuWan web endpoint, which can be triggered to overflow the stack and enable remote arbitrary code execution. Published on 2025-03-14, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction. By submitting a specially crafted request to the vulnerable endpoint, the attacker triggers the stack overflow, allowing arbitrary code execution on the router's stack, which could compromise the device's full control, including network traffic manipulation or use as a pivot point.
The primary reference detailing the vulnerability is a GitHub document at https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan1.md, which likely includes exploit specifics. No vendor advisories or patches are mentioned in the available information.
Details
- CWE(s)