PT-2025-53779 · Kuwfi+1 · Kuwfi 4G Lte Ac900+1

Actuator · Published 2025-12-29 · Updated 2025-12-30 · CVE-2025-68706

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead-Webs on KuWFi 4G LTE AC900 version 1.0.13

Description A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon. The /goform/formMultiApnSetting handler uses sprintf() to copy the pincode parameter, supplied by the user, into a fixed 132-byte stack buffer without proper bounds checking. This can lead to corruption of adjacent stack memory, potentially causing the web server to crash and, under specific circumstances, enabling arbitrary code execution. The vulnerable parameter is pincode.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-68706

Affected Products

Goahead-Webs

Kuwfi 4G Lte Ac900

References · 10

• 🔥 https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt · Exploit
• 🔥 https://github.com/actuator/cve/tree/main/Kuwfi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68706 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68706 · Vendor Advisory
• https://twitter.com/CVEnew/status/2005719012206878879 · Twitter Post
• https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port · Note
• https://twitter.com/VulmonFeeds/status/2005826358320976142 · Twitter Post
• https://t.me/CVEtracker/40867 · Telegram Post
• https://drive.proton.me/urls/HJCJYAC7JM#XtHcm3P7QaYk · Note
• https://t.me/cveNotify/147075 · Telegram Post