CVE-2025-8017
Published: 22 July 2025
Summary
CVE-2025-8017 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac7 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A stack-based buffer overflow vulnerability exists in Tenda AC7 version 15.03.06.44. It affects the formSetMacFilterCfg function in the /goform/setMacFilterCfg endpoint of the httpd component, where improper handling of the deviceList argument triggers the flaw. The issue is tracked under CVE-2025-8017 with a CVSS v4 score of 7.4 and is also associated with CWE-119 and CWE-121.
An authenticated remote attacker can supply a crafted deviceList value to overflow the stack, leading to potential arbitrary code execution or full compromise of the affected device. The vulnerability can be reached over the network without user interaction, and a working exploit has already been published.
Public references include a detailed proof-of-concept on GitHub along with entries on VulDB, but no vendor advisory or patch information is provided in the available sources. The EPSS score remains flat at 0.0164 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22320
Vulnerability details
A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is…
more
possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's public httpd web endpoint (/goform/setMacFilterCfg) directly enables remote exploitation of a public-facing application, resulting in arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow in formSetMacFilterCfg by applying firmware updates to eliminate the flaw.
Validates the deviceList input to the /goform/setMacFilterCfg endpoint to prevent stack buffer overflow from malformed data.
Implements memory protections such as stack canaries and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.