CVE-2025-70753
Published: 13 January 2026
Summary
CVE-2025-70753 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated crafted request to public-facing router web interface (T1190) triggers stack buffer overflow resulting in application/system crash (T1499.004).
NVD Description
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Deeper analysisAI
CVE-2025-70753 is a stack-based buffer overflow vulnerability (CWE-787, CWE-121) in the Tenda AX-1806 router running firmware version v1.0.0.1. The flaw resides in the security_5g parameter handled by the sub_4CA50 function, which can be triggered by a specially crafted request to cause a Denial of Service (DoS) condition.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low complexity, no privileges, and no user interaction required. Remote attackers can send a malicious request to the affected device, disrupting its availability—likely resulting in a crash or reboot—without impacting confidentiality or integrity.
References for this CVE point to a GitHub repository (https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/8/1.md), which documents the vulnerability but provides no details on official advisories, patches, or specific mitigation steps in the available information.
Details
- CWE(s)