Cyber Posture

CVE-2025-12611

HighPublic PoC

Published: 03 November 2025

Published
03 November 2025
Modified
05 November 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0024 47.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-12611 is a buffer overflow vulnerability (CWE-119, CWE-120) in Tenda AC21 routers running firmware version 16.03.08.16. The flaw affects the formSetPPTPServer function in the /goform/SetPptpServerCfg file, where manipulation of the startIp argument triggers the overflow.

The vulnerability enables remote exploitation by attackers with low privileges (PR:L), requiring network access, low complexity, and no user interaction, as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing full compromise of the affected device. A public exploit is available and might be used.

Advisories and additional details are available via references including VulDB entries (ctiid.330906, id.330906, submit.678491), a GitHub issue at LX-LX88/cve/issues/10, and the Tenda website at tenda.com.cn. Practitioners should consult these for any patch availability or mitigation guidance.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ac21 firmware
16.03.08.16

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote buffer overflow in router web management interface (/goform/SetPptpServerCfg) enables exploitation of public-facing application for RCE (T1190) and application crash/DoS (T1499.004), with public PoC available.

References