Cyber Posture

CVE-2025-12618

High

Published: 03 November 2025

Published
03 November 2025
Modified
05 November 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 45.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-12618 is a buffer overflow vulnerability in Tenda AC8 routers running firmware version 16.03.34.06. The flaw affects an unknown function in the /goform/DatabaseIniSet file, where manipulation of the "Time" argument triggers the overflow. Published on 2025-11-03, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWEs 119 and 120.

The vulnerability enables remote exploitation by attackers possessing low privileges, such as authenticated users on the device. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or device takeover.

Advisories and further details are documented on VulDB (https://vuldb.com/?ctiid.330912, https://vuldb.com/?id.330912, https://vuldb.com/?submit.678887) and the Tenda vendor site (https://www.tenda.com.cn/). A proof-of-concept exploit has been publicly disclosed, including at https://pan.baidu.com/s/11fdpTujKw6Xz0yPE2l4cMw.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ac8 firmware
16.03.34.06

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Buffer overflow in Tenda AC8 router's remote web interface (/goform/DatabaseIniSet) enables remote exploitation for initial access or code execution on a public-facing application or remote service.

References