Tenda AC18 CVE-2025-11324

Exploitation requires network reach to the Tenda AC18 HTTP management interface and the ability to invoke /goform/setNotUpgrade with an attacker-controlled newVersion argument; the CVSS vector's PR:L indicates some authenticated/low-privilege access to the device is needed rather than fully anonymous access. Limiting factors: the flaw affects only firmware 15.03.05.19(6318) on the specific AC18 model, the management interface must be reachable by the attacker (typically LAN-side unless remote administration/WAN management is enabled), and successful code execution depends on defeating any device-level mitigations - otherwise the realistic outcome may be a denial-of-service crash of the router.

This is a stack-based buffer overflow (CWE-119) in the Tenda AC18 router firmware 15.03.05.19(6318), reachable over the network via the /goform/setNotUpgrade endpoint by manipulating the newVersion argument. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring some low-level privileges (PR:L) and no user interaction, with high impact to confidentiality, integrity and availability but no scope change to subsequent systems. Publicly available exploit code exists (referenced GitHub PoC), yet the EPSS score is low at 0.83% (56th percentile), and the CVE is NOT listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis. Signals are therefore consistent but modest: a working PoC against a consumer SOHO router raises real risk for exposed/management-plane-reachable devices, but the low EPSS, absence of KEV, and the PR:L authentication requirement suggest this is not yet mass-exploited and depends on an attacker already having some authenticated access or a reachable admin interface. Net: a credible, patch-worthy flaw for exposed Tenda AC18 units rather than an internet-wide emergency.

An attacker with low-level authenticated access to the Tenda AC18 web/management interface sends a crafted request to /goform/setNotUpgrade containing an oversized newVersion value, overflowing a stack buffer. A public proof-of-concept exists (noahze01/IoT-vulnerable GitHub repo), lowering the barrier to triggering the overflow and potentially achieving code execution or a device crash. Given AV:N/AC:L, the request can be delivered remotely over the network without user interaction once the attacker can reach the endpoint.