Cyber Posture

CVE-2025-25678

Critical

Published: 20 February 2025

Published
20 February 2025
Modified
10 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 25.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25678 is a buffer overflow vulnerability (CWE-120) affecting the Tenda i12 router on firmware version V1.0.0.10(3805). The flaw exists in the formSetCfm function, triggered via a specially crafted funcpara1 parameter, and was published on 2025-02-20.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and no change in scope. Remote attackers can thus trigger the buffer overflow without authentication, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or system crashes.

Details on the vulnerability, including a proof-of-concept, are documented in the GitHub repository at https://github.com/jangfan/my-vuln/blob/main/Tenda/i12V1/setcfm.md. No vendor advisories or patches are referenced in the available information.

Details

CWE(s)
CWE-120

Affected Products

tenda
i12 firmware
1.0.0.10\(3805\)

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in unauthenticated public-facing web form (formSetCfm) on router enables remote code execution, directly matching exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References