Cyber Resilience

CVE-2025-7921

Critical

Published: 21 July 2025

Published
21 July 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0138 80.7th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7921 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

Certain modem models from Askey contain a stack-based buffer overflow vulnerability tracked as CVE-2025-7921 and CWE-121. The flaw resides in the modem firmware and permits unauthenticated remote attackers to manipulate program control flow, with the potential to execute arbitrary code on affected devices.

The vulnerability is exploitable over the network without credentials or user interaction, as reflected in its CVSS 4.0 score of 9.3. An attacker who supplies a crafted payload can achieve full control of the execution path, leading to remote code execution on the modem.

Public advisories from Taiwan’s CERT (TW-CERT) describe the issue and list the impacted Askey models; the references do not detail specific patches or configuration workarounds in the supplied information. The associated EPSS score remains low and unchanged at 0.0138, indicating limited observed exploitation interest to date.

EU & UK References

Vulnerability details

Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and potentially execute arbitrary code.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated RCE via network-accessible buffer overflow on public-facing modem service enables remote exploitation of exposed applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-11779Shared CWE-121
CVE-2026-25823Shared CWE-121
CVE-2025-69766Shared CWE-121
CVE-2025-60691Shared CWE-121
CVE-2019-25364Shared CWE-121
CVE-2026-39047Shared CWE-121
CVE-2025-69764Shared CWE-121
CVE-2019-25319Shared CWE-121
CVE-2025-54491Shared CWE-121
CVE-2026-42469Shared CWE-121

Affected Assets

Org
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the stack-based buffer overflow vulnerability through timely application of vendor patches or firmware updates.

prevent

Implements memory protections like stack canaries, ASLR, and non-executable memory to block control flow hijacking from stack buffer overflows.

prevent

Enforces input validation and bounds checking on unauthenticated remote network inputs to prevent exploitation of the buffer overflow.

References