CVE-2025-29387
Published: 14 March 2025
Summary
CVE-2025-29387 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac9 Firmware. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the wanSpeed parameter in the /goform/AdvSetMacMtuWan endpoint to prevent stack buffer overflow from crafted inputs.
Deploys memory protection mechanisms such as stack canaries, ASLR, and DEP to mitigate exploitation of the stack-based buffer overflow vulnerability.
Mandates timely flaw remediation through firmware updates to eliminate the stack overflow in Tenda AC9 v1.0 V15.03.05.14_multi.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow in the /goform/AdvSetMacMtuWan web endpoint of the Tenda AC9 router enables remote arbitrary code execution on a public-facing network device.
NVD Description
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Deeper analysisAI
CVE-2025-29387 is a stack overflow vulnerability affecting the Tenda AC9 v1.0 router running firmware version V15.03.05.14_multi. The issue resides in the wanSpeed parameter handled by the /goform/AdvSetMacMtuWan endpoint, which can be triggered to cause a buffer overflow. Published on 2025-03-14, the vulnerability is rated with a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-787 (Out-of-bounds Write) and CWE-121 (Stack-based Buffer Overflow), potentially enabling remote arbitrary code execution.
Exploitation requires network access, high attack complexity, low privileges (PR:L), and user interaction (UI:R), such as an authenticated user with low privileges submitting a specially crafted request to the vulnerable endpoint. A successful attack could grant an attacker high-impact confidentiality, integrity, and availability compromises, including remote code execution on the affected device within the unchanged security scope.
A technical write-up detailing the vulnerability, including likely proof-of-concept information, is available in the referenced GitHub repository at https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan2.md. No official vendor advisories or patches are specified in available information.
Details
- CWE(s)