CVE-2025-9297
Published: 21 August 2025
Summary
CVE-2025-9297 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda I22 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-9297 is a stack-based buffer overflow vulnerability affecting the Tenda i22 router on firmware version 1.0.0.3(4687). The flaw resides in the formWeixinAuthInfoGet function within the /goform/wxportalauth file, where manipulation of the "Type" argument triggers the overflow. Published on 2025-08-21, it is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow) and carries a CVSS v3.1 base score of 8.8.
The vulnerability enables remote exploitation over the network with low attack complexity and no user interaction required. Exploitation requires low privileges (PR:L) from an authenticated user, potentially allowing attackers to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). A public proof-of-concept exploit is available, increasing the risk of widespread abuse.
Advisories and references, including GitHub repositories from davybat/IoT-Vuls and VulDB entries (ctiid.320902, id.320902), detail the vulnerability and provide a PoC but do not specify patches or vendor mitigations. Security practitioners should isolate affected devices and monitor for exploitation attempts given the public exploit.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28831
Vulnerability details
A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. Performing manipulation of the argument Type results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and…
more
may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing web endpoint (/goform/wxportalauth) of Tenda i22 router enables remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the 'Type' argument in formWeixinAuthInfoGet to prevent stack-based buffer overflow from improper input handling.
Implements memory safeguards like stack canaries and DEP to protect against stack-based buffer overflows even if input validation fails.
Remediates the specific buffer overflow flaw in Tenda i22 firmware through timely patching or replacement to eliminate the vulnerability.