CVE-2025-8178
Published: 26 July 2025
Summary
CVE-2025-8178 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac10 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the heap-based buffer overflow flaw in the Tenda AC10 firmware by identifying, prioritizing, and applying vendor patches.
Requires validation of the 'device1D' argument in /goform/RequestsProcessLaid to block malformed inputs that trigger the heap buffer overflow.
Implements memory protection mechanisms such as heap canaries or safe unlinking to mitigate exploitation of the heap buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote heap buffer overflow in public web form (/goform/RequestsProcessLaid) directly enables T1190 (Exploit Public-Facing Application) on the router; successful exploitation yields arbitrary code execution and full device compromise from low privileges, mapping to T1068 (Exploitation for Privilege Escalation).
NVD Description
A vulnerability classified as critical has been found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /goform/RequestsProcessLaid. The manipulation of the argument device1D leads to heap-based buffer overflow. It is possible to launch the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-8178 is a critical heap-based buffer overflow vulnerability (CWE-119, CWE-122) affecting Tenda AC10 routers running firmware version 16.03.10.13. The flaw resides in an unknown function within the /goform/RequestsProcessLaid file, where manipulation of the "device1D" argument triggers the overflow.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 8.8 (C:H/I:H/A:H). Successful exploitation could grant high impacts on confidentiality, integrity, and availability, potentially allowing full compromise of the affected device.
VulDB advisories note that an exploit has been publicly disclosed and may be used in attacks. No specific patches or mitigations are detailed in the available references; security practitioners should monitor the vendor site at https://www.tenda.com.cn/ and related advisories such as those on VulDB for updates.
Details
- CWE(s)