CVE-2025-7544
Published: 13 July 2025
Summary
CVE-2025-7544 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac1206 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-7544 is a stack-based buffer overflow vulnerability affecting the Tenda AC1206 wireless router running firmware version 15.03.06.23. The issue exists in the formSetMacFilterCfg function of the /goform/setMacFilterCfg endpoint and is triggered by unsanitized input to the deviceList argument, resulting in memory corruption tracked under CWE-119 and CWE-121.
An authenticated remote attacker can supply a crafted deviceList value to overflow the stack, potentially leading to arbitrary code execution or a crash that disrupts device operation. The CVSS 4.0 score of 7.4 reflects network attack vector, low complexity, and high impact on confidentiality, integrity, and availability with no user interaction required.
Public references include a detailed proof-of-concept on GitHub and corresponding entries on Vuldb, confirming the flaw has been disclosed but providing no official vendor patch or mitigation guidance. The associated EPSS score has remained flat at 0.0170 with no material rise since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21279
Vulnerability details
A vulnerability was found in Tenda AC1206 15.03.06.23. It has been rated as critical. This issue affects the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's public-facing web interface (/goform/setMacFilterCfg) via remote manipulation of deviceList enables exploitation of a public-facing application for potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the deviceList argument in formSetMacFilterCfg to prevent stack-based buffer overflows from malformed or oversized inputs.
Implements memory protections like stack canaries, ASLR, and non-executable memory to block exploitation of the stack buffer overflow for arbitrary code execution.
Mandates timely identification, reporting, and remediation of the buffer overflow flaw in the Tenda AC1206 firmware via patching or secure code updates.