CVE-2025-0848
Published: 30 January 2025
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2025-0848 is a stack-based buffer overflow vulnerability affecting Tenda A18 router firmware versions up to 15.13.07.09. The issue resides in the SetCmdlineRun function within the /goform/SetCmdlineRun component of the HTTP POST request handler, where manipulation of the wpapsk_crypto5g argument triggers the overflow. Published on 2025-01-30, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is mapped to CWEs 119, 121, and 787.
The vulnerability is exploitable remotely by attackers with network access who possess low privileges, such as an authenticated web interface user, under low complexity conditions and without requiring user interaction. Exploitation results in high availability impact, enabling denial-of-service effects like device crashes, with no compromise to confidentiality or integrity.
VulDB advisories (ctiid.294011, id.294011, submit.485802) document the vulnerability details, while a GitHub repository (alc9700jmo/CVE/issues/9) discloses a public proof-of-concept exploit. The Tenda website provides a reference for vendor-specific guidance.
The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stack-based buffer overflow in HTTP POST handler (/goform/SetCmdlineRun) enables remote code execution without authentication, facilitating exploitation of public-facing applications and remote services on the router.