CVE-2025-9087
Published: 16 August 2025
Summary
CVE-2025-9087 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac20 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the manipulated argument list inputs to the set_qosMib_list function, preventing the stack-based buffer overflow in the /goform/SetNetControlList endpoint.
Implements memory safeguards such as stack canaries, ASLR, and DEP to protect against stack-based buffer overflows like the one in set_qosMib_list.
Requires timely identification, reporting, and patching of the buffer overflow flaw in Tenda AC20 firmware version 16.03.08.12 to prevent remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the remote web endpoint (/goform/SetNetControlList) enables remote code execution on the Tenda AC20 router, facilitating T1190 (Exploit Public-Facing Application) and T1210 (Exploitation of Remote Services).
NVD Description
A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetNetControlList Endpoint. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-9087 is a stack-based buffer overflow vulnerability affecting Tenda AC20 router firmware version 16.03.08.12. The flaw resides in the set_qosMib_list function of the /goform/SetNetControlList endpoint within the SetNetControlList component, triggered by manipulation of the argument list. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with network access and low privileges can exploit this vulnerability remotely with low complexity and no user interaction. Successful exploitation enables high-impact outcomes on confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device.
References point to a public proof-of-concept exploit, including a Python script on GitHub, confirming that the exploit has been disclosed and may be used. VulDB entries document the issue but provide no specific details on patches or vendor mitigations in the available information.
Details
- CWE(s)