CVE-2025-8160
Published: 25 July 2025
Summary
CVE-2025-8160 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac20 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical buffer overflow vulnerability has been identified in the Tenda AC20 wireless router running firmware up to version 16.03.08.12. The flaw resides in an unknown function within the /goform/SetSysTimeCfg endpoint of the httpd component and is triggered by improper handling of the timeZone argument, corresponding to CWE-119 and CWE-120 weaknesses.
An authenticated remote attacker can supply a crafted timeZone value to the affected endpoint, causing memory corruption that may result in arbitrary code execution or denial of service. The attack requires no user interaction and can be launched over the network; a publicly available proof-of-concept exploit has already been released.
No vendor advisory or patch information is provided in the referenced sources, which include a public exploit disclosure on GitHub, multiple VulDB entries, and the vendor website. The EPSS score has remained flat at 0.0120 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22705
Vulnerability details
A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the component httpd. The manipulation of the argument timeZone leads to buffer overflow. It is possible…
more
to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing httpd (/goform/SetSysTimeCfg) enables remote exploitation for initial access (T1190) and application/system DoS (T1499.004), with public PoC confirming remote trigger for crash or potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identifying, reporting, and correcting system flaws like this buffer overflow, directly mitigated by applying vendor patches or firmware updates for the affected Tenda AC20 httpd component.
SI-10 mandates validating information inputs such as the timeZone argument at the /goform/SetSysTimeCfg endpoint to prevent buffer overflows from malformed data.
SI-16 implements memory safeguards like address space layout randomization or data execution prevention to mitigate arbitrary code execution from successful buffer overflows.