CVE-2025-67073
Published: 17 December 2025
Description
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely patching and remediation of known vulnerabilities like CVE-2025-67073 in the Tenda firmware to eliminate the buffer overflow flaw.
SI-10 requires validation of untrusted inputs such as the crafted serviceName field in POST requests to /goform/AdvSetMacMtuWan to prevent buffer overflows.
SI-16 employs memory protections like stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow for code execution or DoS.
Security SummaryAI
CVE-2025-67073 is a buffer overflow vulnerability (CWE-120) in the fromAdvSetMacMtuWan function of the bin httpd component in Tenda AC10V4.0 firmware version V16.03.10.20. Published on 2025-12-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact confidentiality, integrity, and availability effects.
The vulnerability can be exploited by remote attackers over the network with no privileges or user interaction required. By sending a POST request to the /goform/AdvSetMacMtuWan endpoint containing a crafted payload in the `serviceName` field, attackers can trigger the buffer overflow, resulting in denial of service or possibly remote code execution on the affected device.
Mitigation details are available in the advisory referenced at https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67073.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a buffer overflow in the public-facing httpd web server component of a router firmware, exploitable remotely via crafted HTTP POST request for RCE or DoS, directly mapping to exploitation of public-facing applications.