CVE-2025-29101
Published: 20 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-29101 is a stack-based buffer overflow vulnerability (CWE-121) in the Tenda AC8 V4.0 router running firmware version V16.03.34.06. The flaw occurs in the get_parentControl_list_Info function when processing the deviceid parameter, potentially leading to memory corruption. Published on 2025-03-20, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, using low-complexity techniques. Exploitation results in a denial-of-service condition with high availability impact, such as device crashes or reboots, though no confidentiality or integrity impacts are present.
Details on the vulnerability, including a proof-of-concept, are available in the referenced GitHub repository at https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_get_parentControl_list_Info_overflow.md. No vendor advisories, patches, or specific mitigation guidance are detailed in the provided information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing router web function enables T1190 (Exploit Public-Facing Application) and directly causes DoS via T1499.004 (Application or System Exploitation).