CVE-2025-68706

A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attack...

EUVD-2025-205631

A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attack...

CVE-2025-68706

A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attack...

KuWFi 4G LTE AC900 安全漏洞

KuWFi 4G LTE AC900 is a WiFi router from KuWFi China. A security vulnerability exists in KuWFi 4G LTE AC900 version 1.0.13, which stems from a lack of bounds checking leading to a stack buffer overflow that could result in a crash or execution of arbitrary code...

CVE-2025-68706

A stack-based buffer overflow vulnerability exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices running firmware 1.0.13 . The /goform/formMultiApnSetting handler improperly uses sprintf() to copy a user-supplied pincode parameter into a fixed 132-byte stack buffer without perform...

CVE-2024-53946

The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...

CVE-2024-53946

The KuWFi 4G LTE AC900 router version 1.0.13 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within its web management interface. An attacker can deceive an authenticated administrator into performing unauthorized actions, specifically by triggering a command injection vulnerability loc...