CVE-2025-22904

CVE-2025-22904 is a stack-based buffer overflow vulnerability in RE11S version 1.11, triggered through the pptpUserName parameter in the setWAN function. This flaw, classified under CWE-120, affects the software component handling WAN configuration, likely within Edimax networking devices as indicated by associated references. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility and potential for severe impacts.

A remote attacker requires no privileges or user interaction to exploit this issue over the network with low complexity. Successful exploitation could allow arbitrary code execution, leading to high confidentiality, integrity, and availability impacts, such as full device compromise, data theft, or disruption of network services.

References include the RE11S vendor site (re11s.com), a GitHub proof-of-concept repository demonstrating the stack overflow (github.com/xyqer1/RE11S_1.11-setWAN-3-StackOverflow), and Edimax's global site (edimax.com), though specific mitigation or patch details are not detailed in available information.