CVE-2025-22904 describes a stack overflow vulnerability in RE11S v1.11 triggered by the pptpUserName parameter within the setWAN function. This vulnerability allows unauthenticated remote attackers to potentially execute arbitrary code or disrupt service due to improper bounds checking on input data. The CVSS 3.1 score of 9.8 reflects critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or mitigation guidance has been published as of the vulnerability's disclosure date.

Successful exploitation of this stack overflow vulnerability can lead to remote code execution or denial of service, compromising system confidentiality, integrity, and availability. The vulnerability requires no authentication and can be triggered remotely, increasing the risk of exploitation. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for unusual activity related to the pptpUserName parameter in the setWAN function. Avoid exposing the vulnerable service to untrusted networks.