Cyber Posture

CVE-2025-0848

MediumPublic PoC

Published: 30 January 2025

Published
30 January 2025
Modified
06 March 2025
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0010 28.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-0848 is a stack-based buffer overflow vulnerability affecting Tenda A18 router firmware versions up to 15.13.07.09. The issue resides in the SetCmdlineRun function within the /goform/SetCmdlineRun component of the HTTP POST request handler, where manipulation of the wpapsk_crypto5g argument triggers the overflow. Published on 2025-01-30, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is mapped to CWEs 119, 121, and 787.

The vulnerability is exploitable remotely by attackers with network access who possess low privileges, such as an authenticated web interface user, under low complexity conditions and without requiring user interaction. Exploitation results in high availability impact, enabling denial-of-service effects like device crashes, with no compromise to confidentiality or integrity.

VulDB advisories (ctiid.294011, id.294011, submit.485802) document the vulnerability details, while a GitHub repository (alc9700jmo/CVE/issues/9) discloses a public proof-of-concept exploit. The Tenda website provides a reference for vendor-specific guidance.

The exploit has been publicly disclosed and may be used in attacks.

Details

CWE(s)
CWE-119CWE-121CWE-787

Affected Products

tenda
a18 firmware
15.13.07.09

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Stack-based buffer overflow in HTTP POST handler (/goform/SetCmdlineRun) enables remote code execution without authentication, facilitating exploitation of public-facing applications and remote services on the router.

References