CVE-2025-70648
Published: 21 January 2026
Summary
CVE-2025-70648 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1803 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-70648 is a stack overflow vulnerability in the Tenda AX1803 router running firmware version v1.0.0.1. The issue resides in the security_5g parameter handled by the sub_727F4 function, which can be triggered by a specially crafted request. It is classified under CWE-121 (Stack-based Buffer Overflow) and carries a CVSS v3.1 base score of 7.5, reflecting high severity due to its potential for disruption.
Remote attackers can exploit this vulnerability over the network without authentication or user interaction, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. Successful exploitation leads to a Denial of Service (DoS) condition by crashing the device, rendering it unavailable (A:H) with no impact on confidentiality or integrity (C:N/I:N).
Mitigation details are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/6/1.md, published alongside the CVE disclosure on 2026-01-21.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3649
Vulnerability details
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing router firmware directly enables T1190 (exploit of exposed web/config interface) and T1499.004 (DoS via crafted input triggering crash).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates inputs to the security_5g parameter in the sub_727F4 function to prevent stack overflows from crafted requests.
Implements memory protection mechanisms such as stack canaries to mitigate exploitation of the stack-based buffer overflow.
Requires timely installation of firmware patches to remediate the specific stack overflow vulnerability in Tenda AX1803 v1.0.0.1.