Tenda AC18 CVE-2025-11325

Exploitation requires sending a request to the /goform/fast_setting_pppoe_set endpoint - the router's PPPoE fast-setup handler - with an oversized 'Username' parameter on a Tenda AC18 running firmware 15.03.05.19(6318). Per the CVSS 4.0 vector (PR:L), the attacker needs at least low-privileged authenticated access to the device's web interface, which limits exploitation to LAN-adjacent users, credentialed users, or cases where the management interface is exposed to the WAN/Internet. No user interaction is required (UI:N). The principal limiting factors are the authentication prerequisite and the need for the specific vulnerable firmware build; note the description does not explicitly name the auth requirement, so pre-auth reachability of this goform handler should be confirmed against the device.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw that nonetheless requires some level of privilege (PR:L) - i.e. the attacker must already be authenticated to the router's web interface, which meaningfully lowers real-world risk versus a fully unauthenticated bug. Impact is high across confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with a stack-based buffer overflow (CWE-119) that can crash the device or potentially execute code. Public exploit code exists (confirmed via the GitHub PoC reference), yet EPSS is low at 0.80% (55th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. The low EPSS despite a public PoC is typical of the very large volume of VulDB-reported Tenda/IoT overflow CVEs, which are rarely mass-exploited. Net: this is a genuine but second-tier issue - prioritize patching/replacing the affected device where feasible, but it does not rise to emergency status. One caveat to verify: the CVSS 4.0 vector sets PR:L while the description says only 'the attack is possible to be carried out remotely' without naming an authentication prerequisite - confirm whether the /goform endpoint actually requires a session, as several Tenda goform handlers are reachable pre-auth.

An attacker with access to the router's web management interface (e.g. a logged-in low-privileged user, or an attacker on the LAN or an Internet-exposed admin panel) sends a crafted POST to /goform/fast_setting_pppoe_set with an overlong 'Username' value. This overflows a stack buffer in the PPPoE fast-setup handler, crashing the device or potentially executing attacker-controlled code on the router. A public proof-of-concept for this exact endpoint is already published on GitHub.