CVE-2025-70651
Published: 21 January 2026
Summary
CVE-2025-70651 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1803 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-70651 is a stack-based buffer overflow vulnerability (CWE-121) in the Tenda AX-1803 router running firmware version 1.0.0.1. The flaw resides in the ssid parameter handled by the form_fast_setting_wifi_set function, which fails to properly validate input lengths, leading to a stack overflow condition. This issue was publicly disclosed on January 21, 2026, and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for remote disruption.
Unauthenticated attackers with network access to the vulnerable device can exploit this flaw by sending a specially crafted HTTP request targeting the affected function. Successful exploitation triggers the stack overflow, causing the router to crash and resulting in a Denial of Service (DoS) that renders the device unavailable until rebooted. No privileges, user interaction, or special conditions are required, making it accessible to remote adversaries scanning for exposed Tenda AX-1803 routers.
Mitigation details and technical analysis are documented in the advisory available at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/4/1.md. Security practitioners should check for firmware updates from Tenda, restrict administrative interface exposure, and monitor for unusual HTTP traffic to the device.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3654
Vulnerability details
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack overflow in public-facing router web function directly enables T1190 exploitation; resulting crash maps to T1499.004 system exploitation for DoS impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack overflow vulnerability in the form_fast_setting_wifi_set function through timely firmware updates.
Requires validation of the ssid parameter to prevent stack overflows from crafted HTTP requests lacking length checks.
Protects the router against denial-of-service effects from remote exploitation of the buffer overflow crash.