CVE-2025-29029
Published: 14 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-29029 is a buffer overflow vulnerability (CWE-787) affecting Tenda AC6 routers running version v15.03.05.16. The issue resides in the formSetSpeedWan function, which can be triggered to cause an out-of-bounds write. Published on 2025-03-14, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical severity.
An unauthenticated remote attacker with network access to the device can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation enables high-impact consequences across confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the router.
Mitigation details are available in the referenced advisory at https://github.com/WhereisDoujo/CVE/issues/2.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in the router's public-facing web interface (formSetSpeedWan) enables exploitation for initial access (T1190) and denial of service via application exploitation leading to crash (T1499.004).