Cyber Posture

CVE-2025-14655

HighPublic PoC

Published: 14 December 2025

Published
14 December 2025
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime results in stack-based buffer overflow. The attack is…

more

possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation through vendor firmware patching directly eliminates the stack-based buffer overflow in the formSetRebootTimer function.

SI-10 Information Input Validation good match
prevent

Information input validation on the rebootTime argument prevents the manipulation that triggers the stack-based buffer overflow.

SI-16 Memory Protection partial match
prevent

Memory protection mechanisms like stack canaries and ASLR mitigate exploitation of the stack-based buffer overflow even if the input flaw exists.

Security SummaryAI

CVE-2025-14655 is a stack-based buffer overflow vulnerability affecting the Tenda AC20 router running firmware version 16.03.08.12. The flaw resides in the formSetRebootTimer function within the /goform/SetSysAutoRebbotCfg file of the httpd component, where manipulation of the rebootTime argument triggers the overflow.

Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. According to the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful exploitation enables high-impact consequences on confidentiality, integrity, and availability, potentially leading to remote code execution.

Advisories and details are documented on VulDB (ctiid.336388, id.336388, submit.712910), with a public exploit released on GitHub at https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN13/AC20_SetSysAutoRebbotCfg.md. The Tenda vendor website (https://www.tenda.com.cn/) provides general product information, but specific patch or mitigation guidance is not detailed in the referenced sources.

The exploit's public availability heightens the risk for unpatched Tenda AC20 devices. The vulnerability is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).

Details

CWE(s)
CWE-119CWE-121CWE-787

Affected Products

tenda
ac20 firmware
16.03.08.12

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Stack-based buffer overflow in router's httpd web interface (/goform/SetSysAutoRebbotCfg) enables remote exploitation of public-facing application (T1190), exploitation of remote services for code execution (T1210), and application DoS via crash (T1499.004).

References