CVE-2025-70746
Published: 16 January 2026
Summary
CVE-2025-70746 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-70746 is a stack overflow vulnerability (CWE-121) affecting the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the timeZone parameter handled by the fromSetSysTime function, which can be triggered by a specially crafted request. It has a CVSS v3.1 base score of 7.5, rated as High severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for high-impact availability disruption without affecting confidentiality or integrity.
Remote attackers with network access to the vulnerable device can exploit this issue without authentication by sending a malicious request to the affected function, resulting in a stack overflow that causes a Denial of Service (DoS). This leads to device crashes or reboots, rendering the router unavailable and potentially disrupting network services for users relying on it.
Further technical details, including proof-of-concept information, are documented in the advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/4/1.md. No vendor patches or specific mitigation guidance are detailed in the CVE publication from January 16, 2026.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2927
Vulnerability details
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in network-accessible router function (fromSetSysTime) directly enables unauthenticated remote exploitation of a public-facing device for DoS via application/system crash (T1190 for initial exploitation vector; T1499.004 for resulting availability impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs like the timeZone parameter to block crafted requests causing stack overflow.
Mandates timely remediation of the identified stack overflow flaw through firmware patching or updates.
Implements protections to limit or prevent the denial-of-service effects from stack overflow-induced crashes and reboots.