CVE-2025-7914
Published: 21 July 2025
Summary
CVE-2025-7914 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac6 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents buffer overflow exploitation by validating and sanitizing inputs to the vulnerable setparentcontrolinfo function in the httpd component.
Implements memory safeguards such as stack canaries, ASLR, and DEP to block arbitrary code execution even if the buffer overflow in httpd is triggered.
Requires timely firmware updates to remediate the known buffer overflow vulnerability in Tenda AC6 httpd version 15.03.06.50.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the httpd web server component of a network device (router) directly enables remote exploitation of a public-facing application by authenticated attackers, leading to RCE.
NVD Description
A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the component httpd. The manipulation leads to buffer overflow. The attack can be launched remotely.
Deeper analysisAI
CVE-2025-7914 is a critical buffer overflow vulnerability (CWE-119, CWE-120) in Tenda AC6 routers running firmware version 15.03.06.50. The flaw affects the setparentcontrolinfo function within the httpd component, where remote manipulation triggers the overflow.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited remotely by attackers possessing low privileges, such as authenticated users. Exploitation requires low complexity and no user interaction, potentially enabling high-impact compromise of confidentiality, integrity, and availability, including arbitrary code execution or system crashes.
Advisories on VulDB (ctiid.317029, id.317029, submit.618859) and a GitHub repository (gaochen61/IoTVuln) provide details on the issue, including a proof-of-concept for the Tenda AC6 V15.03.06.50 setparentcontrolinfo endpoint. The Tenda manufacturer website (tenda.com.cn) is referenced for further information.
Details
- CWE(s)