CVE-2025-29030
Published: 14 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-29030 is a buffer overflow vulnerability (CWE-787) affecting Tenda AC6 routers running version v15.03.05.16. The flaw resides in the formWifiWpsOOB function and was published on 2025-03-14T14:15:18.200. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, and with low complexity. Successful exploitation grants high confidentiality, integrity, and availability impacts, enabling arbitrary code execution, data compromise, or device takeover on affected routers.
Mitigation details are available in the referenced advisory at https://github.com/WhereisDoujo/CVE/issues/3.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The buffer overflow in the router's web form (/goform/WifiWpsOOB) enables remote exploitation of a public-facing application via crafted HTTP POST requests, potentially leading to code execution or denial of service.