CVE-2025-70656
Published: 15 January 2026
Summary
CVE-2025-70656 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-70656 is a stack overflow vulnerability (CWE-121) in the Tenda AX-1806 router running firmware version 1.0.0.1. The issue resides in the mac parameter processed by the sub_65B5C function, which can be triggered by a specially crafted request to induce a Denial of Service (DoS) condition. Published on 2026-01-15, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for significant availability disruption.
The vulnerability is exploitable by unauthenticated attackers over the network with low complexity and no user interaction required. By sending a malicious request targeting the affected parameter, an attacker can overflow the stack, likely causing the device to crash or reboot, thereby denying service to legitimate users. There is no impact on confidentiality or integrity.
Mitigation details and a proof-of-concept are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/11/1.md. Security practitioners should monitor for firmware updates from Tenda and apply network segmentation or access controls to exposed router interfaces in the interim.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2744
Vulnerability details
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in public router web interface directly enables remote unauthenticated exploitation for DoS via application/system crash (T1190 + T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires applying vendor firmware updates to fix the stack overflow in the sub_65B5C function, directly preventing DoS via crafted mac parameter requests.
Information input validation enforces checks on the mac parameter for proper format and length, preventing stack overflows from malformed requests.
Denial-of-service protection implements rate limiting and resource controls to block repeated crafted requests that crash the router.