Tenda AC18 CVE-2025-11328

Exploitation requires network reachability to the router's HTTP management interface and the ability to invoke the /goform/SetDDNSCfg endpoint with a manipulated ddnsEn parameter. The CVSS vector specifies PR:L, meaning a low-privilege authenticated session to the web UI is required - this is the primary limiting factor, as the admin/web interface should not be exposed to the WAN/internet in default or security-conscious deployments. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to the exact affected firmware build, Tenda AC18 firmware 15.03.05.19(6318); other models or firmware revisions are not asserted as affected. Realistic exposure is highest where the router management interface is reachable (e.g., LAN attacker, or misconfigured remote management) and credentials are weak, default, or already obtained.

This is a stack-based buffer overflow (CWE-119) in the Tenda AC18 router web interface (/goform/SetDDNSCfg, argument ddnsEn). The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L), with high impact to confidentiality, integrity, and availability on the device itself (no subsequent-system scope change). Exploitation status: publicly available exploit code exists (POC on GitHub), but the vulnerability is NOT in CISA KEV - there is no confirmation of active exploitation in the wild. The EPSS score is low (1.07%, 64th percentile), consistent with a public POC for a niche consumer device that has not yet seen widespread automated exploitation. The CVSS 4.0 Exploit Maturity is E:P (proof-of-concept), aligning with the POC-but-not-KEV signals. Net assessment: this is a genuine, exploitable memory-corruption flaw with public exploit code, but real-world risk is moderate rather than critical because the affected product is a specific consumer router firmware build (limited enterprise footprint), exploitation requires authentication (PR:L), and there is no evidence of mass exploitation. The high CVSS impact reflects device takeover potential, not fleet-wide risk. Note a signal tension: PR:L authentication requirement plus low EPSS suggests opportunistic/targeted exploitation of exposed, credentialed admin interfaces rather than widespread unauthenticated worming.

An attacker with access to the router's web management interface (requiring low-privilege authentication per CVSS PR:L) sends a crafted request to /goform/SetDDNSCfg with an oversized or malformed ddnsEn argument, overflowing a stack buffer. A public proof-of-concept exploit is available on GitHub, lowering the barrier to reproduction. Successful exploitation can crash the device (denial of service) or potentially achieve arbitrary code execution on the router.