CVE-2025-9523
Published: 27 August 2025
Summary
CVE-2025-9523 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac1206 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely firmware patching directly remediates the stack-based buffer overflow in the GetParentControlInfo function exploited via the 'mac' argument.
Validating the length and format of the 'mac' argument prevents the buffer overflow triggered by malformed remote inputs.
Stack canaries, ASLR, and DEP mitigate successful exploitation of the buffer overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack-based buffer overflow in the Tenda AC1206 router's web endpoint (/goform/GetParentControlInfo) enables exploitation of a public-facing application and remote service, facilitating initial access or lateral movement (T1190, T1210) and endpoint denial of service through application exploitation (T1499.004).
NVD Description
A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now…
more
public and may be used.
Deeper analysisAI
CVE-2025-9523 is a stack-based buffer overflow vulnerability affecting the Tenda AC1206 router on firmware version 15.03.06.23. The flaw exists in the GetParentControlInfo function within the /goform/GetParentControlInfo file, where manipulation of the 'mac' argument triggers the overflow.
The vulnerability enables remote exploitation over the network with no authentication requirements, low attack complexity, and no user interaction needed, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution and full device compromise.
Advisories on VulDB (ctiid.321541, id.321541, submit.634309) document the issue, while a public exploit is available in the GitHub repository XXRicardo/iot-cve for the Tenda AC1206 V1.0RTL_V15.03.06.23. The Tenda website (tenda.com.cn) is referenced, though no specific patches or mitigations are detailed in the provided sources.
The exploit is public and may be used, heightening risks for unpatched Tenda AC1206 devices.
Details
- CWE(s)