Cyber Posture

CVE-2025-28221

High

Published: 28 March 2025

Published
28 March 2025
Modified
08 May 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0060 69.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-28221 is a buffer overflow vulnerability affecting the Tenda W6_S router running firmware version 1.0.0.4_510. The issue resides in the set_local_time function, which fails to properly validate the 'time' parameter passed via a POST request to the binary, leading to a buffer overflow condition.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no authentication privileges, user interaction, or special conditions, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation results in a denial-of-service condition by crashing the web server, disrupting device availability without impacting confidentiality or integrity.

For mitigation details, refer to the advisory at https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/time.pdf. The vulnerability was published on 2025-03-28.

Details

CWE(s)
CWE-120

Affected Products

tenda
w6-s firmware
1.0.0.4\(510\)

MITRE ATT&CK Enterprise Techniques

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer overflow in the router web server's set_local_time function allows remote unauthenticated exploitation to crash the service, directly mapping to application/system exploitation for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References