CVE-2025-11549
Published: 09 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-11549 is a stack-based buffer overflow vulnerability in the Tenda W12 router running firmware version 3.0.0.6(3948). The issue resides in the wifiMacFilterSet function within the /goform/modules file of the HTTP Request Handler component. By manipulating the 'mac' argument in a crafted HTTP request, an attacker triggers the overflow, as associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The attack can be conducted remotely over the network with low complexity and requires low privileges (PR:L), such as those of an authenticated user on the device. No user interaction is needed, and exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data theft, or device compromise.
Advisories from VulDB detail the vulnerability and note that a proof-of-concept exploit has been publicly disclosed on GitHub, making it readily usable by attackers. The vendor's website (tenda.com.cn) is referenced, but no specific patches or mitigations are outlined in available details; security practitioners should check for firmware updates directly from Tenda.
Notable context includes the public availability of the exploit, increasing the risk of real-world abuse against unpatched Tenda W12 devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Remote stack-based buffer overflow in the Tenda W12 router's HTTP handler (wifiMacFilterSet) enables arbitrary code execution via crafted requests to a public-facing web interface.