Cyber Posture

CVE-2025-29101

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
25 March 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0044 63.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-29101 is a stack-based buffer overflow vulnerability (CWE-121) in the Tenda AC8 V4.0 router running firmware version V16.03.34.06. The flaw occurs in the get_parentControl_list_Info function when processing the deviceid parameter, potentially leading to memory corruption. Published on 2025-03-20, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, using low-complexity techniques. Exploitation results in a denial-of-service condition with high availability impact, such as device crashes or reboots, though no confidentiality or integrity impacts are present.

Details on the vulnerability, including a proof-of-concept, are available in the referenced GitHub repository at https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_get_parentControl_list_Info_overflow.md. No vendor advisories, patches, or specific mitigation guidance are detailed in the provided information.

Details

CWE(s)
CWE-121

Affected Products

tenda
ac8 firmware
16.03.34.06

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated stack buffer overflow in public-facing router web function enables T1190 (Exploit Public-Facing Application) and directly causes DoS via T1499.004 (Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References