CVE-2025-25668
Published: 20 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-25668 is a stack overflow vulnerability in the Tenda AC8V4 router firmware version V16.03.34.06. The flaw occurs in the sub_47D878 function when processing the shareSpeed parameter, classified under CWE-120 (Buffer Copy without Checking Size of Input). It was published on 2025-02-20.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged impact scope. Remote attackers require only network access to trigger the stack overflow, potentially achieving high confidentiality, integrity, and availability impacts such as arbitrary code execution or denial of service.
Mitigation details are available in the referenced advisory at https://github.com/jangfan/my-vuln/blob/main/Tenda/AC8V4/setMacFilterCfg.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stack overflow vulnerability in Tenda AC8V4 router firmware via web parameter (shareSpeed) enables remote exploitation of a public-facing application for potential code execution.