Description
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.
References (4)
Core 4
Core References
Third Party Advisory
https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt
Third Party Advisory
https://github.com/actuator/cve/tree/main/Kuwfi
Scores
CVSS v3
9.8
EPSS
0.0019
EPSS Percentile
41.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-121
Status
published
Products (1)
kuwfi/ac900_firmware
1.0.13
Published
Dec 29, 2025
Tracked Since
Feb 18, 2026