CVE-2025-67073
Published: 17 December 2025
Summary
CVE-2025-67073 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely patching and remediation of known vulnerabilities like CVE-2025-67073 in the Tenda firmware to eliminate the buffer overflow flaw.
SI-10 requires validation of untrusted inputs such as the crafted serviceName field in POST requests to /goform/AdvSetMacMtuWan to prevent buffer overflows.
SI-16 employs memory protections like stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow for code execution or DoS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a buffer overflow in the public-facing httpd web server component of a router firmware, exploitable remotely via crafted HTTP POST request for RCE or DoS, directly mapping to exploitation of public-facing applications.
NVD Description
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.
Deeper analysisAI
CVE-2025-67073 is a buffer overflow vulnerability (CWE-120) in the fromAdvSetMacMtuWan function of the bin httpd component in Tenda AC10V4.0 firmware version V16.03.10.20. Published on 2025-12-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact confidentiality, integrity, and availability effects.
The vulnerability can be exploited by remote attackers over the network with no privileges or user interaction required. By sending a POST request to the /goform/AdvSetMacMtuWan endpoint containing a crafted payload in the `serviceName` field, attackers can trigger the buffer overflow, resulting in denial of service or possibly remote code execution on the affected device.
Mitigation details are available in the advisory referenced at https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67073.
Details
- CWE(s)