Cyber Posture

CVE-2025-29030

CriticalPublic PoC

Published: 14 March 2025

Published
14 March 2025
Modified
19 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-29030 is a buffer overflow vulnerability (CWE-787) affecting Tenda AC6 routers running version v15.03.05.16. The flaw resides in the formWifiWpsOOB function and was published on 2025-03-14T14:15:18.200. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, and with low complexity. Successful exploitation grants high confidentiality, integrity, and availability impacts, enabling arbitrary code execution, data compromise, or device takeover on affected routers.

Mitigation details are available in the referenced advisory at https://github.com/WhereisDoujo/CVE/issues/3.

Details

CWE(s)
CWE-787

Affected Products

tenda
ac6 firmware
15.03.05.16

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The buffer overflow in the router's web form (/goform/WifiWpsOOB) enables remote exploitation of a public-facing application via crafted HTTP POST requests, potentially leading to code execution or denial of service.

References