What is the CVSS score of EUVD-2025-21338?

EUVD-2025-21338 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for EUVD-2025-21338?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21338. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2025-21338?

Within 24 hours: Identify and inventory all Tenda AX1803 devices across the organization and isolate affected units from production networks if operationally feasible. Within 7 days: Implement network segmentation to restrict administrative access to affected devices and deploy WAF/IDS rules to block exploitation attempts targeting /goform/setWifiFilterCfg endpoints. Within 30 days: Develop and execute a device replacement plan with alternative router models that receive active vendor support, prioritizing devices on externally-facing or critical network segments.

Ax1803 Firmware EUVD-2025-21338

| CVE-2025-7598 HIGH

Buffer Overflow (CWE-119)

2025-07-14 cna@vuldb.com

RCE Buffer Overflow Tenda Ax1803 Firmware

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 8.8 (High/Critical) with vector AV:N/AC:L/PR:L/UI:N/S:U indicates a remotely exploitable flaw requiring only low-privilege authentication (PR:L) with no user interaction. The authentication requirement (PR:L) is the primary mitigating control, limiting exposure to users with valid credentials or those who can obtain them via social engineering or credential theft. However, given that 1) public exploit code exists, 2) the vulnerability is likely automatable (stack overflow with fixed-size buffer), 3) technical impact is maximal (code execution), and 4) the device class (home router) often has weak credential hygiene, real-world risk is elevated. EPSS score would likely be high (>0.60) given public POC availability and ease of exploitation. Unlike unauthenticated RCE, this requires initial access but represents a significant lateral movement and persistence risk within compromised networks. The vulnerability should be prioritized for patches on exposed or internet-accessible instances.
Exploit ScenarioDerived	An attacker with valid router credentials (obtained via phishing, brute-force, or default credentials) sends a crafted HTTP POST request to /goform/setWifiFilterCfg with an oversized deviceList parameter containing shellcode. The oversized input overflows the stack buffer, overwriting the function return address. Upon function return, execution jumps to attacker-controlled code, achieving remote code execution. The attacker gains root access to the router, enabling: persistent backdoor installation, MITM attacks on network traffic, lateral movement to connected devices, DNS hijacking, and botnet recruitment. Given public POC availability, this could be chained with credential theft tactics (weak defaults, social engineering) to automate large-scale router compromises.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

CVE-2025-7598 is a critical stack-based buffer overflow vulnerability in Tenda AX1803 router (version 1.0.0.1) affecting the WiFi MAC filter configuration endpoint. An authenticated remote attacker can exploit improper input validation in the deviceList parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impacts). Public exploit code has been disclosed and the vulnerability may be actively exploited.

RemediationAI

{'type': 'patch', 'description': "Update Tenda AX1803 firmware to version newer than 1.0.0.1. Check Tenda's official support website (https://www.tenda.com.cn or regional variant) for latest firmware release.", 'priority': 'Critical', 'note': 'Specific patched version not disclosed in public CVE data; contact Tenda support or monitor their security advisories.'} {'type': 'mitigation', 'description': 'Restrict LAN access to the router management interface (/goform endpoints) via firewall rules. Disable remote management if enabled.', 'priority': 'High'} {'type': 'mitigation', 'description': 'Enforce strong, unique credentials for router administrative access to reduce likelihood of unauthorized authenticated access.', 'priority': 'High'} {'type': 'workaround', 'description': 'Isolate Tenda AX1803 from trusted networks containing sensitive systems until patch is available. Consider replacing device with patched alternative if critical deployment.', 'priority': 'Medium'}

Affected VersionsENISA

AX1803 1.0.0.1

Affected Packages

euvd ax1803 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the formSetWifiMacFilterCfg function within the /goform/setWifiFilterCfg endpoint of Tenda AX1803 firmware. This is a network device management interface vulnerable to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The deviceList parameter is passed to a fixed-size stack buffer without proper bounds checking, allowing an attacker to overflow adjacent stack memory including return addresses. Tenda AX1803 is a budget WiFi router running proprietary firmware; the affected endpoint is accessible via HTTP/HTTPS from the LAN management interface. The CPE identifier would be cpe:2.3:h:tenda:ax1803:1.0.0.1:*:*:*:*:*:*:* for the hardware and corresponding firmware component.

Know when Ax1803 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Jul 16, 2025 - 14:33 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 11:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1. Affected by this vulnerability is the function formSetWifiMacFilterCfg of the file /goform/setWifiFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A remotely exploitable buffer overflow vulnerability (CVE-2025-7598) affecting Tenda AX1803 wireless routers has been publicly disclosed with working exploit code available. Organizations using this device model are at immediate risk of unauthorized access, network compromise, and potential lateral movement into corporate networks, particularly if these devices serve as network entry points or are used in remote office deployments.

Business Impact: High

Compensating Controls

Implement network access controls restricting administrative interfaces to trusted IP ranges only; deploy intrusion detection signatures monitoring for buffer overflow exploitation patterns on port 80/443; disable the WiFi MAC filtering feature if operationally acceptable; isolate affected devices to DMZ or restricted VLANs; consider deploying a WAF with request filtering for the /goform/setWifiFilterCfg path; monitor affected devices for anomalous behavior and unauthorized administrative access attempts.

Threat Intelligence Overview

EPSS Score

0.4%

Top 43% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.