Cyber Resilience

CVE-2025-70644

HighPublic PoC

Published: 21 January 2026

Published
21 January 2026
Modified
26 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0013 31.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70644 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-70644, published on 2026-01-21, is a stack overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version 1.0.0.1. The flaw resides in the 'time' parameter handled by the sub_60CFC function, which can be triggered via a crafted HTTP request. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Remote attackers require only network access to the vulnerable router, with low attack complexity, no authentication privileges, and no user interaction needed. By sending a specially crafted request targeting the affected parameter, an attacker can overflow the stack, causing the device to crash and resulting in a Denial of Service (DoS) condition that renders the router unavailable.

Mitigation details are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/3/1.md. No vendor patches or workarounds are specified in the provided CVE data.

EU & UK References

Vulnerability details

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Stack overflow in public web interface (HTTP parameter) directly enables remote unauthenticated exploitation of a network device for DoS via application/system exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-70744Same product: Tenda Ax1806
CVE-2025-71019Same product: Tenda Ax1806
CVE-2025-70656Same product: Tenda Ax1806
CVE-2025-71021Same product: Tenda Ax1806
CVE-2025-70746Same product: Tenda Ax1806
CVE-2025-70645Same product: Tenda Ax1806
CVE-2025-70747Same product: Tenda Ax1806
CVE-2025-70650Same product: Tenda Ax1806
CVE-2025-70753Same product: Tenda Ax1806
CVE-2025-71020Same product: Tenda Ax1806

Affected Assets

tenda
ax1806 firmware
1.0.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Validates the 'time' parameter in HTTP requests to the sub_60CFC function, preventing stack overflow from crafted oversized or malformed inputs.

SI-2 Flaw Remediation good match
prevent

Identifies, reports, and remediates the stack overflow flaw in Tenda AX-1806 firmware v1.0.0.1 through timely security updates.

SC-5 Denial-of-service Protection good match
prevent

Implements denial-of-service protections to detect and limit crafted HTTP requests that trigger router crashes via stack overflow.

References