What is the CVSS score of CVE-2025-7597?

CVE-2025-7597 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ax1803 Firmware are affected by CVE-2025-7597?

A critical remote code execution vulnerability affects Tenda AX1803 routers (version 1.0.0.1) with no available patch and active public exploits.

Is there a public PoC exploit available for CVE-2025-7597?

Yes, a public proof-of-concept exploit is available for CVE-2025-7597. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-7597?

Within 24 hours: Identify all Tenda AX1803 devices in your environment and isolate them from production networks if possible, or place them behind a restrictive firewall. Within 7 days: Implement WAF rules to block POST requests to /goform/setMacFilterCfg endpoint; disable MAC filtering feature if operationally feasible; segment affected devices to a restricted VLAN with minimal trust access. Within 30 days: Evaluate replacement with patched firmware versions or alternative router models from vendors with active security support; establish inventory controls to prevent future deployment of end-of-life devices.

Ax1803 Firmware CVE-2025-7597

EUVD-2025-21340 HIGH

Buffer Overflow (CWE-119)

2025-07-14 cna@vuldb.com

Buffer Overflow Ax1803 Firmware Tenda

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21340

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 15, 2025 - 18:27 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 11:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7597 is a critical stack-based buffer overflow vulnerability in Tenda AX1803 router firmware (version 1.0.0.1) affecting the MAC filter configuration function. An authenticated attacker can remotely exploit this via the deviceList parameter to achieve remote code execution with full system compromise (confidentiality, integrity, availability). A public exploit has been disclosed and the vulnerability may be actively exploited.

Technical ContextAI

The vulnerability exists in the formSetMacFilterCfg function within the /goform/setMacFilterCfg web interface handler on Tenda AX1803 routers. The root cause is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The deviceList parameter lacks proper bounds checking when processed by the CGI handler, allowing an attacker to write beyond allocated stack memory. This is a classic memory safety issue in embedded device firmware, likely written in C/C++ without modern compiler protections or runtime bounds checking. The attack surface is the web management interface accessible after authentication, making it part of the device's HTTP server component.

RemediationAI

Immediate remediation options: (1) Firmware patch: Check Tenda's support website for AX1803 firmware updates newer than 1.0.0.1. Apply the latest available firmware version immediately. (2) Access controls: Restrict access to the web management interface (typically port 80/443) using firewall rules—disable WAN access if not required, limit LAN access to trusted systems. (3) Credential hardening: Change default admin credentials immediately if not already done. (4) Network segmentation: Isolate router management traffic from general user network traffic. (5) Vendor contact: Contact Tenda support to confirm patch availability timeline if not yet released. (6) Temporary mitigation: If patching is delayed, disable remote management access and restrict local access to trusted administrators only. Note: Tenda devices often have slow patching cycles; end-of-life devices may not receive patches.