CVE-2025-68706 json
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13.
published 2025-12-29 10 mo ago modified 2026-10-13 27 d ago also EUVD-2025-205631
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.0%
- EPSS 5.0% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
4.97% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-121 Stack-based Buffer Overflow
References
-
kuwfi.com
/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-
product
-
github.com
/actuator/cve/tree/main/Kuwfi
third-party-advisory
-
drive.proton.me
/urls/HJCJYAC7JM#XtHcm3P7QaYk
broken-link
-
github.com
/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt
third-party-advisory
Sources
- CVE List CVE-2025-68706
- NVD CVE-2025-68706
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.