Cyber Posture

CVE-2025-70644

HighPublic PoC

Published: 21 January 2026

Published
21 January 2026
Modified
26 January 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 22.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70644 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Stack overflow in public web interface (HTTP parameter) directly enables remote unauthenticated exploitation of a network device for DoS via application/system exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Deeper analysisAI

CVE-2025-70644, published on 2026-01-21, is a stack overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version 1.0.0.1. The flaw resides in the 'time' parameter handled by the sub_60CFC function, which can be triggered via a crafted HTTP request. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Remote attackers require only network access to the vulnerable router, with low attack complexity, no authentication privileges, and no user interaction needed. By sending a specially crafted request targeting the affected parameter, an attacker can overflow the stack, causing the device to crash and resulting in a Denial of Service (DoS) condition that renders the router unavailable.

Mitigation details are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/3/1.md. No vendor patches or workarounds are specified in the provided CVE data.

Details

CWE(s)

Affected Products

tenda
ax1806 firmware
1.0.0.1

CVEs Like This One

CVE-2025-70746Same product: Tenda Ax1806
CVE-2025-70656Same product: Tenda Ax1806
CVE-2025-70747Same product: Tenda Ax1806
CVE-2025-71019Same product: Tenda Ax1806
CVE-2025-71021Same product: Tenda Ax1806
CVE-2025-70744Same product: Tenda Ax1806
CVE-2025-70645Same product: Tenda Ax1806
CVE-2025-70753Same product: Tenda Ax1806
CVE-2025-71020Same product: Tenda Ax1806
CVE-2025-70650Same product: Tenda Ax1806

References