Cyber Posture

CVE-2025-1851

High

Published: 03 March 2025

Published
03 March 2025
Modified
10 April 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0117 78.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-1851 is a critical stack-based buffer overflow vulnerability affecting Tenda AC7 routers running firmware versions up to 15.03.06.44. The issue resides in the formSetFirewallCfg function within the /goform/SetFirewallCfg endpoint, where manipulation of the firewallEn argument triggers the overflow. Classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on March 3, 2025.

The vulnerability enables remote exploitation by low-privileged users (PR:L), requiring no user interaction and low attack complexity over the network. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution, denial of service, or full compromise of the affected device.

Advisories from VulDB and a public GitHub repository detail the vulnerability, including a disclosed exploit in the Raining-101/IOT_cve project targeting the specific firmware version. No vendor patch is referenced in available sources, though the Tenda website is listed for potential firmware updates. Security practitioners should isolate affected devices and monitor for exploitation attempts given the public PoC availability.

The exploit has been publicly disclosed and may be actively used, increasing risk for unpatched Tenda AC7 deployments in home or small office environments.

Details

CWE(s)
CWE-119CWE-121

Affected Products

tenda
ac7 firmware
≤ 15.03.06.44

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in the public-facing web management interface (/goform/SetFirewallCfg) of Tenda AC7 router allows remote unauthenticated attackers to achieve root code execution via crafted firewallEn input.

References