PT-2025-53779 · Kuwfi+1 · Kuwfi 4G Lte Ac900+1

Actuator · Publicado 2025-12-29 · Atualizado 2025-12-30 · CVE-2025-68706

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead-Webs on KuWFi 4G LTE AC900 version 1.0.13

Description A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon. The /goform/formMultiApnSetting handler uses sprintf() to copy the pincode parameter, supplied by the user, into a fixed 132-byte stack buffer without proper bounds checking. This can lead to corruption of adjacent stack memory, potentially causing the web server to crash and, under specific circumstances, enabling arbitrary code execution. The vulnerable parameter is pincode.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

CVE-2025-68706

Produtos afetados

Goahead-Webs

Kuwfi 4G Lte Ac900

Referências · 10

• 🔥 https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt · Exploit
• 🔥 https://github.com/actuator/cve/tree/main/Kuwfi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68706 · Nota de Segurança
• https://twitter.com/CVEnew/status/2005719012206878879 · Publicação no Twitter
• https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port · Nota
• https://twitter.com/VulmonFeeds/status/2005826358320976142 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68706 · Aviso do Fabricante
• https://t.me/CVEtracker/40867 · Publicação no Telegram
• https://drive.proton.me/urls/HJCJYAC7JM#XtHcm3P7QaYk · Nota
• https://t.me/cveNotify/147075 · Publicação no Telegram