Cyber Posture

CVE-2025-70648

HighPublic PoC

Published: 21 January 2026

Published
21 January 2026
Modified
26 January 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 22.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70648 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1803 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated stack buffer overflow in public-facing router firmware directly enables T1190 (exploit of exposed web/config interface) and T1499.004 (DoS via crafted input triggering crash).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Deeper analysisAI

CVE-2025-70648 is a stack overflow vulnerability in the Tenda AX1803 router running firmware version v1.0.0.1. The issue resides in the security_5g parameter handled by the sub_727F4 function, which can be triggered by a specially crafted request. It is classified under CWE-121 (Stack-based Buffer Overflow) and carries a CVSS v3.1 base score of 7.5, reflecting high severity due to its potential for disruption.

Remote attackers can exploit this vulnerability over the network without authentication or user interaction, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. Successful exploitation leads to a Denial of Service (DoS) condition by crashing the device, rendering it unavailable (A:H) with no impact on confidentiality or integrity (C:N/I:N).

Mitigation details are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/6/1.md, published alongside the CVE disclosure on 2026-01-21.

Details

CWE(s)

Affected Products

tenda
ax1803 firmware
1.0.0.1

CVEs Like This One

CVE-2025-70651Same product: Tenda Ax1803
CVE-2025-70646Same product: Tenda Ax1803
CVE-2026-1329Same product: Tenda Ax1803
CVE-2025-7598Same product: Tenda Ax1803
CVE-2025-7597Same product: Tenda Ax1803
CVE-2025-70746Same vendor: Tenda
CVE-2025-29121Same vendor: Tenda
CVE-2025-70656Same vendor: Tenda
CVE-2025-29214Same vendor: Tenda
CVE-2025-70747Same vendor: Tenda

References