CVE-2025-68706
Unknown Unknown - Not Provided
Stack-Based Buffer Overflow in KuWFi AC900 GoAhead-Webs Enables Code Execution

Publication date: 2025-12-29

Last updated on: 2025-12-29

Assigner: MITRE

Description
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-29
Last Modified
2025-12-29
Generated
2026-06-16
AI Q&A
2025-12-29
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68706
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
kuwfi 4g_lte_ac900 1.0.13
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. Specifically, the /goform/formMultiApnSetting handler uses sprintf() to copy a user-supplied 'pincode' parameter into a fixed 132-byte stack buffer without checking the length. This can overwrite adjacent stack memory, potentially crashing the web server or allowing an attacker to execute arbitrary code under certain conditions.

Impact Analysis

An attacker exploiting this vulnerability can cause the web server on the affected device to crash, leading to denial of service. Additionally, under certain conditions, the attacker may be able to execute arbitrary code on the device, which could lead to full compromise of the device, unauthorized access, or further attacks within the network.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart