CVE-2025-70650
Published: 21 January 2026
Summary
CVE-2025-70650 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-70650 is a stack-based buffer overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the deviceList parameter of the formSetMacFilterCfg function, which can be triggered by processing malformed input. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for remote denial-of-service disruption.
Unauthenticated attackers with network access to the vulnerable device can exploit this issue by sending a specially crafted HTTP request to the formSetMacFilterCfg endpoint. Successful exploitation leads to a stack overflow, causing the router to crash and become unavailable, resulting in a denial-of-service condition. No user interaction or privileges are required, and the low attack complexity makes it accessible to remote adversaries targeting exposed Tenda AX-1806 devices.
A technical advisory detailing the vulnerability, including proof-of-concept information, is available at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/1/1.md. No official vendor patches or mitigation guidance from Tenda are referenced in the CVE details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3667
Vulnerability details
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in the router's public web management interface (formSetMacFilterCfg) directly enables exploitation of a public-facing application for denial-of-service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the deviceList parameter in HTTP requests to prevent stack overflow from malformed inputs.
Mandates timely remediation of the stack overflow flaw in formSetMacFilterCfg through firmware patching or upgrades.
Implements memory protections such as stack canaries to mitigate exploitation of the stack-based buffer overflow causing crashes.