Cyber Posture

CVE-2025-70744

HighPublic PoC

Published: 15 January 2026

Published
15 January 2026
Modified
20 January 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 22.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70744 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated stack overflow in public-facing router web interface directly enables T1190 exploitation and T1499.004 application/system exploitation for DoS impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Deeper analysisAI

CVE-2025-70744 is a stack overflow vulnerability affecting the Tenda AX-1806 router running firmware version 1.0.0.1. The flaw resides in the cloneType parameter handled by the sub_65B5C function and is classified under CWE-121 (Stack-based Buffer Overflow). Published on 2026-01-15, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Unauthenticated attackers with network access can exploit this vulnerability by sending a specially crafted request to the affected device. The attack requires low complexity and no user interaction, allowing remote exploitation without privileges. Successful exploitation triggers the stack overflow, causing a Denial of Service (DoS) that renders the router unavailable.

Security practitioners should consult the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/10/1.md for additional technical details and potential mitigation steps.

Details

CWE(s)

Affected Products

tenda
ax1806 firmware
1.0.0.1

CVEs Like This One

CVE-2025-70746Same product: Tenda Ax1806
CVE-2025-70656Same product: Tenda Ax1806
CVE-2025-70747Same product: Tenda Ax1806
CVE-2025-71019Same product: Tenda Ax1806
CVE-2025-71021Same product: Tenda Ax1806
CVE-2025-70644Same product: Tenda Ax1806
CVE-2025-70645Same product: Tenda Ax1806
CVE-2025-70753Same product: Tenda Ax1806
CVE-2025-71020Same product: Tenda Ax1806
CVE-2025-70650Same product: Tenda Ax1806

References