CVE-2025-9605
Published: 29 August 2025
Summary
CVE-2025-9605 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac21 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires identifying, reporting, and correcting system flaws like this stack-based buffer overflow, enabling firmware patching to eliminate the vulnerability.
SI-10 mandates validating information inputs such as the 'mac' argument to prevent buffer overflows from improper restriction of operations within memory bounds.
SI-16 implements memory protections like stack canaries and non-executable stacks to safeguard against stack-based buffer overflow exploits leading to arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated stack-based buffer overflow in the web management interface (/goform/GetParentControlInfo) enables remote code execution on Tenda AC21/AC23 routers, facilitating exploitation of public-facing applications and remote services.
NVD Description
A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit…
more
has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2025-9605 is a stack-based buffer overflow vulnerability affecting Tenda AC21 and AC23 routers on firmware version 16.03.08.16. The flaw resides in the GetParentControlInfo function within the /goform/GetParentControlInfo endpoint, where manipulation of the 'mac' argument triggers the overflow. Published on 2025-08-29, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges or user interaction to exploit the vulnerability over the network with low complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the targeted device.
References point to GitHub repositories with publicly disclosed proof-of-concept exploits for Tenda AC21 (V16.03.08.16) and AC23 (noted variant V16.03.07.52), alongside VulDB entries (ctiid.321783, id.321783, submit.636545) confirming remote exploitability. No vendor patches or specific mitigation guidance appear in the provided details.
Details
- CWE(s)