Cyber Posture

CVE-2025-25667

CriticalPublic PoC

Published: 20 February 2025

Published
20 February 2025
Modified
17 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25667 is a stack overflow vulnerability (CWE-120) in Tenda AC8V4 routers running firmware version V16.03.34.06. The flaw occurs in the get_parentControl_list_Info function when processing the urls parameter, allowing buffer overflow conditions that can corrupt the stack.

The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and unchanged scope (S:U), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Unauthenticated remote attackers can exploit this over the network to potentially achieve arbitrary code execution, data disclosure, modification of router settings, or denial-of-service by crashing the device.

Additional technical details, including a proof-of-concept, are documented in a GitHub repository at https://github.com/jangfan/my-vuln/blob/main/Tenda/AC8V4/saveParentControlInfo.md. No vendor advisories or patches are referenced in available information.

Details

CWE(s)
CWE-120

Affected Products

tenda
ac8 firmware
16.03.34.06

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack overflow in the web interface function get_parentControl_list_Info via urls parameter enables remote exploitation of a public-facing application on the Tenda router for potential code execution.

References