CVE-2025-70645
Published: 21 January 2026
Summary
CVE-2025-70645 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web function (formSetWifiMacFilterCfg) directly enables remote unauthenticated exploitation (T1190) resulting in application/system crash DoS (T1499.004).
NVD Description
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Deeper analysisAI
CVE-2025-70645 is a stack-based buffer overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the deviceList parameter of the formSetWifiMacFilterCfg function, which can be triggered by a specially crafted request. Published on 2026-01-21 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it poses a high-impact risk primarily to availability.
Remote attackers require only network access to the vulnerable device, with no authentication, privileges, or user interaction needed. By sending a malicious request to the affected function, an exploiter can trigger the stack overflow, causing the router to crash and resulting in a denial of service (DoS) condition that disrupts network connectivity until the device is rebooted.
Further technical details, including proof-of-concept information, are documented in a GitHub advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/2/1.md. No vendor patches or specific mitigation guidance are detailed in available sources at this time.
Details
- CWE(s)