{"id":"CVE-2025-68706","title":"A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13","summary":"A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-121"],"vendor":"kuwfi","product":"ac900_firmware","affected":["ac900_firmware = 1.0.13"],"published":"2025-12-29","updated":"2026-10-13","sourceUpdated":"2026-10-13T10:10:00.193","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68706","references":[{"url":"https://drive.proton.me/urls/HJCJYAC7JM#XtHcm3P7QaYk","label":"cve@mitre.org"},{"url":"https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt","label":"cve@mitre.org"},{"url":"https://github.com/actuator/cve/tree/main/Kuwfi","label":"cve@mitre.org"},{"url":"https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.04971,"epssPercentile":0.92003,"ingestedAt":"2026-10-13T10:22:03.532Z","slug":"CVE-2025-68706","body":"## Overview\n\nA stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.\n\n## Affected\n\n- `ac900_firmware = 1.0.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":53.9,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}