Tenda AC18 CVE-2025-11327

Exploitation requires reaching the router's HTTP management interface and, per the CVSS PR:L metric, holding low-privilege authenticated access to it (on SOHO devices this frequently means default or weak admin credentials). The specific trigger is a request to the /goform/SetUpnpCfg endpoint with an overlong upnpEn argument; no end-user interaction is required (UI:N). Limiting factors: the attacker must be able to route to the web interface - trivial on the LAN, but internet-wide exploitation depends on the WAN-side/remote-management interface being exposed, which is not the default for most deployments; this constraint, combined with the authentication requirement, substantially narrows realistic remote exploitation despite AV:N.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low privileges, with high confidentiality/integrity/availability impact confined to the device (no scope change). Publicly available exploit code exists (GitHub PoC by noahze01), which raises practical risk, but there is NO CISA KEV listing - so this is 'publicly available exploit code exists', not confirmed active exploitation; do not conflate the two. EPSS is low at 1.24% (68th percentile), indicating the prediction models do not expect widespread opportunistic exploitation in the near term, which fits a specific consumer router model rather than a mass-internet target. The PR:L metric implies the attacker needs authenticated access to the router's web interface (commonly the admin/default credential on SOHO devices), which meaningfully limits remote-internet exploitation unless the management interface is WAN-exposed with weak/default credentials. Net: a genuine code-execution bug with a public PoC, but EPSS and the lack of KEV suggest it is not currently a widespread priority - most relevant to defenders with Tenda AC18 units exposing management interfaces.

An attacker with access to the router's web management interface (e.g., via LAN, or WAN if remote management is enabled, often with default/weak credentials) sends a crafted request to /goform/SetUpnpCfg with an oversized upnpEn parameter. This overflows a stack buffer in the handler, allowing arbitrary code execution on the device. A public proof-of-concept for this exact endpoint is available on GitHub.