CVE-2025-70746
Published: 16 January 2026
Summary
CVE-2025-70746 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in network-accessible router function (fromSetSysTime) directly enables unauthenticated remote exploitation of a public-facing device for DoS via application/system crash (T1190 for initial exploitation vector; T1499.004 for resulting availability impact).
NVD Description
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Deeper analysisAI
CVE-2025-70746 is a stack overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the timeZone parameter handled by the fromSetSysTime function, which can be triggered by a specially crafted request. It has a CVSS v3.1 base score of 7.5, rated as High severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for high-impact availability disruption without affecting confidentiality or integrity.
Remote attackers with network access to the vulnerable device can exploit this issue without authentication by sending a malicious request to the affected function, resulting in a stack overflow that causes a Denial of Service (DoS). This leads to device crashes or reboots, rendering the router unavailable and potentially disrupting network services for users relying on it.
Further technical details, including proof-of-concept information, are documented in the advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/4/1.md. No vendor patches or specific mitigation guidance are detailed in the CVE publication from January 16, 2026.
Details
- CWE(s)