CVE-2025-68706
Unknown Unknown - Not Provided

Stack-Based Buffer Overflow in KuWFi AC900 GoAhead-Webs Enables Code Execution

Publication date: 2025-12-29

Last updated on: 2025-12-29

Assigner: MITRE

Description
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-29
Last Modified
2025-12-29
Generated
2026-07-06
AI Q&A
2025-12-29
EPSS Evaluated
2026-07-05
NVD
CVE-2025-68706

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kuwfi 4g_lte_ac900 1.0.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. Specifically, the /goform/formMultiApnSetting handler uses sprintf() to copy a user-supplied 'pincode' parameter into a fixed 132-byte stack buffer without checking the length. This can overwrite adjacent stack memory, potentially crashing the web server or allowing an attacker to execute arbitrary code under certain conditions.

Impact Analysis

An attacker exploiting this vulnerability can cause the web server on the affected device to crash, leading to denial of service. Additionally, under certain conditions, the attacker may be able to execute arbitrary code on the device, which could lead to full compromise of the device, unauthorized access, or further attacks within the network.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart