CVE-2025-70645
Published: 21 January 2026
Summary
CVE-2025-70645 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-70645 is a stack-based buffer overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the deviceList parameter of the formSetWifiMacFilterCfg function, which can be triggered by a specially crafted request. Published on 2026-01-21 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it poses a high-impact risk primarily to availability.
Remote attackers require only network access to the vulnerable device, with no authentication, privileges, or user interaction needed. By sending a malicious request to the affected function, an exploiter can trigger the stack overflow, causing the router to crash and resulting in a denial of service (DoS) condition that disrupts network connectivity until the device is rebooted.
Further technical details, including proof-of-concept information, are documented in a GitHub advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/2/1.md. No vendor patches or specific mitigation guidance are detailed in available sources at this time.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3664
Vulnerability details
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web function (formSetWifiMacFilterCfg) directly enables remote unauthenticated exploitation (T1190) resulting in application/system crash DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the stack overflow by requiring validation of the deviceList parameter in crafted requests to prevent buffer overruns.
Implements memory protections such as stack canaries and DEP to block exploitation of the stack-based buffer overflow leading to crashes.
Provides denial-of-service protections to limit the impact of crash-inducing crafted requests on router availability.