CVE-2025-29384
Published: 14 March 2025
Summary
CVE-2025-29384 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Tenda AC9 v1.0 running firmware V15.03.05.14_multi contains a stack-based buffer overflow in the wanMTU parameter processed by the /goform/AdvSetMacMtuWan endpoint. The flaw is tracked as CVE-2025-29384, carries a CVSS 3.1 score of 9.8, and is classified under CWE-787 as an out-of-bounds write that permits remote arbitrary code execution.
An unauthenticated attacker with network access can supply an oversized wanMTU value in a crafted HTTP request to the management interface, triggering the overflow and achieving code execution with the privileges of the web server process. No user interaction or authentication is required, enabling direct remote compromise of the device.
The single public reference is a technical disclosure containing proof-of-concept details; no vendor advisory or firmware update addressing the issue is referenced in the available data. The associated EPSS score has remained in the 0.11–0.15 range without a pronounced post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6520
Vulnerability details
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow vulnerability in the router's web interface (/goform/AdvSetMacMtuWan) enables remote arbitrary code execution, directly mapping to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the wanMTU parameter to prevent stack overflows from specially crafted oversized inputs in the /goform/AdvSetMacMtuWan endpoint.
Implements stack canaries, ASLR, and DEP to protect against exploitation of the stack overflow vulnerability leading to arbitrary code execution.
Requires timely identification, reporting, and patching of the stack overflow flaw in Tenda AC9 firmware to eliminate the vulnerability.