cbcvebase.
CVE-2025-4298
published 2025-05-06

CVE-2025-4298: A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file…

PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.96%
57.5th percentile
A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

25 ranges
VendorProductVersion rangeFixed in
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206——
tendaac1206_firmware<= 15.03.06.23—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/setcfm
path/goform/setcfm↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda setcfm Multiple Parameters Buffer Overflow Attempt (CVE-2025-4298, CVE-2025-57528)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:14; content:"/goform/setcfm"; fast_pattern; http.request_body; pcre:"/funcpara[12]\x3d[^&]{100,}(?:&|$)/"; reference:url,github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formSetCfm/poc.md; reference:cve,2025-4298; reference:cve,2025-57528; reference:url,github.com/faqiadegege/IoTVuln/blob/main/tendaAc6_formSetCfm_funcname_overflow/detail.md; classtype:web-application-attack; sid:2064108; rev:2; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_22, cve CVE_2025_4298, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit uses HTTP POST method targeting the /goform/setcfm endpoint with an exact URI length of 14 bytes.
  • →Buffer overflow is triggered via oversized values (100+ characters) in the funcpara1 or funcpara2 POST body parameters.
  • →Attack is plaintext (non-TLS) and should be detected at the network perimeter and internally.
  • →MITRE ATT&CK mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190).
  • ·Affected product is Tenda AC1206 (and AC6 V2.0RTL) up to firmware version 15.03.06.23 only; later versions may not be vulnerable. ↗
  • ·The Snort/Suricata rule (sid:2064108) also covers CVE-2025-57528 in the same signature; tune accordingly if only targeting CVE-2025-4298.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.