CVE-2025-29386
Published: 14 March 2025
Summary
CVE-2025-29386 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of system flaws like this stack overflow, enabling firmware patching to eliminate the vulnerability.
SI-10 mandates validation of information inputs such as the 'mac' parameter with bounds checking to directly prevent stack buffer overflows from crafted HTTP requests.
SI-16 implements memory protections like stack canaries and DEP to prevent or detect exploitation of stack overflows leading to arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in the /goform/AdvSetMacMtuWan web endpoint enables remote arbitrary code execution on the public-facing router management interface.
NVD Description
In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-29386 is a stack overflow vulnerability (CWE-787) affecting the Tenda AC9 v1.0 router on firmware version V15.03.05.14_multi. The issue resides in the "mac" parameter of the /goform/AdvSetMacMtuWan web endpoint, where insufficient bounds checking allows a stack buffer overflow. This flaw enables remote arbitrary code execution and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
The vulnerability is exploitable by unauthenticated remote attackers with network access to the router's web interface. No privileges, user interaction, or special conditions are required, allowing low-complexity attacks via crafted HTTP requests targeting the vulnerable parameter. Successful exploitation grants attackers arbitrary code execution on the device, with high impacts on confidentiality, integrity, and availability, potentially leading to full router compromise.
Mitigation details are not specified in the CVE publication, published on 2025-03-14. Security practitioners should consult the referenced GitHub advisory at https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan4.md for technical analysis and potential workarounds, while isolating affected devices and monitoring for unusual traffic to the endpoint.
Details
- CWE(s)