CVE-2025-71021
Published: 14 January 2026
Summary
CVE-2025-71021 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Tenda Ax1806 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-71021 is a stack overflow vulnerability affecting the Tenda AX-1806 router running firmware version 1.0.0.1. The flaw resides in the serverName parameter within the sub_65A28 function, which can be triggered by a specially crafted request to cause a Denial of Service (DoS) condition. It is classified under CWE-121 (Stack-based Buffer Overflow).
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impact on availability with no impact on confidentiality or integrity. Unauthenticated remote attackers can exploit it by sending a malicious request, potentially crashing the device and disrupting network services.
Mitigation details are available in the referenced advisory at https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/7/1.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2444
Vulnerability details
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in network-accessible router service directly enables remote unauthenticated exploitation causing endpoint DoS via application crash (T1499.004); also maps to exploiting public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack overflow flaw in the sub_65A28 function via timely firmware patching to eliminate the DoS vulnerability.
Validates the serverName parameter to block crafted oversized requests that trigger the stack-based buffer overflow.
Implements memory protections like stack canaries or non-executable stacks to prevent successful exploitation of the stack overflow leading to DoS.