CVE-2025-29385
Published: 14 March 2025
Summary
CVE-2025-29385 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the cloneType parameter in the /goform/AdvSetMacMtuWan endpoint to prevent stack overflows from malformed inputs leading to RCE.
Ensures timely application of firmware patches to remediate the specific stack overflow vulnerability in Tenda AC9 v1.0.
Deploys memory protection mechanisms like stack canaries and address space layout randomization to block exploitation of the stack overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow vulnerability in the router's web interface endpoint /goform/AdvSetMacMtuWan enables remote arbitrary code execution, directly mapping to exploitation of a public-facing application.
NVD Description
In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-29385 is a stack overflow vulnerability affecting the cloneType parameter in the /goform/AdvSetMacMtuWan endpoint of Tenda AC9 v1.0 routers running firmware version V15.03.05.14_multi. Classified under CWE-787 (Out-of-bounds Write), the flaw enables remote arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critically severe due to its potential for high-impact exploitation.
An unauthenticated attacker with network access can exploit this vulnerability through low-complexity means without requiring user interaction. Successful exploitation allows the attacker to achieve high confidentiality, integrity, and availability impacts, culminating in arbitrary code execution on the targeted router.
Mitigation details and further technical analysis are available in the referenced advisory at https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan3.md.
Details
- CWE(s)