Cyber Posture

CVE-2025-25662

Critical

Published: 20 February 2025

Published
20 February 2025
Modified
07 May 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25662, published on 2025-02-20, is a buffer overflow vulnerability (CWE-120) affecting the Tenda O4 V3.0 device running firmware version V1.0.0.10(2936). The flaw resides in the SafeSetMacFilter function of the /goform/setMacFilterList CGI endpoint and can be triggered by specially crafted values in the remark, type, or time arguments. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.

A remote, unauthenticated attacker can exploit this vulnerability over the network by sending a malicious HTTP request to the vulnerable endpoint. Exploitation requires no privileges or user interaction, enabling low-complexity attacks that could lead to arbitrary code execution, full system compromise, or denial of service on the affected device.

Further technical details, including proof-of-concept information, are available in the referenced advisory at https://github.com/jangfan/my-vuln/blob/main/Tenda/O4V3/setMacFilterList.md. No vendor patches or specific mitigations are detailed in the available information.

Details

CWE(s)
CWE-120

Affected Products

tenda
o4 firmware
1.0.0.10\(2936\)

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in unauthenticated public-facing CGI web endpoint (/goform/setMacFilterList) on network device enables remote arbitrary code execution via crafted HTTP request, directly mapping to exploitation of public-facing applications for initial access and system compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References