Cyber Posture

CVE-2025-67073

CriticalPublic PoC

Published: 17 December 2025

Published
17 December 2025
Modified
02 January 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 mandates timely patching and remediation of known vulnerabilities like CVE-2025-67073 in the Tenda firmware to eliminate the buffer overflow flaw.

prevent

SI-10 requires validation of untrusted inputs such as the crafted serviceName field in POST requests to /goform/AdvSetMacMtuWan to prevent buffer overflows.

prevent

SI-16 employs memory protections like stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow for code execution or DoS.

Security SummaryAI

CVE-2025-67073 is a buffer overflow vulnerability (CWE-120) in the fromAdvSetMacMtuWan function of the bin httpd component in Tenda AC10V4.0 firmware version V16.03.10.20. Published on 2025-12-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact confidentiality, integrity, and availability effects.

The vulnerability can be exploited by remote attackers over the network with no privileges or user interaction required. By sending a POST request to the /goform/AdvSetMacMtuWan endpoint containing a crafted payload in the `serviceName` field, attackers can trigger the buffer overflow, resulting in denial of service or possibly remote code execution on the affected device.

Mitigation details are available in the advisory referenced at https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67073.

Details

CWE(s)

Affected Products

tenda
ac10 firmware
16.03.10.20

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a buffer overflow in the public-facing httpd web server component of a router firmware, exploitable remotely via crafted HTTP POST request for RCE or DoS, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References