Tenda AC23 CVE-2025-11356

Exploitation targets the authenticated web-management handler /goform/SetStaticRouteCfg (the static-route configuration feature) on Tenda AC23 firmware through 16.03.07.52; the attacker must be able to reach the router's HTTP management interface and, per CVSS PR:L, hold at least low-privilege/authenticated access to invoke this endpoint. The overflow is triggered by supplying an over-long 'list' argument that overruns a stack buffer in the sscanf call. Limiting factors: the endpoint is an admin-plane function (not an unauthenticated public service), so realistic abuse depends on obtaining valid, default, or weak credentials, and remote reach requires the management interface to be exposed to the attacker's network (typically LAN, or WAN only if remote management is enabled).

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 (High) and describes a network-reachable, low-complexity buffer overflow requiring low privileges (PR:L), with full confidentiality, integrity and availability impact to the affected device. Publicly available exploit code exists (referenced GitHub writeup and VulDB), and the 4.0 Exploit Maturity is Proof-of-Concept (E:P), so the exploitation signal is 'public PoC' - not confirmed in-the-wild abuse. This CVE is NOT listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation cannot be asserted from the data. Overall this is a genuine but moderate-priority issue: the PR:L requirement (the /goform/SetStaticRouteCfg endpoint is an authenticated router admin function) meaningfully limits mass exploitation, meaning realistic abuse typically presupposes a weak/default/known credential or a chained auth bypass. Note a signal tension to verify: VulDB-sourced Tenda router CVSS vectors routinely rate PR:L even though these /goform endpoints are post-authentication admin handlers - defenders relying on 'low privilege = near-unauthenticated' should confirm the actual authentication state of SetStaticRouteCfg against the firmware. EPSS and KEV data are both absent and should be checked before final prioritization.

An attacker with access to the router's web management interface (or valid/default admin credentials) sends a crafted request to /goform/SetStaticRouteCfg with an overly long 'list' argument, overflowing a stack buffer in the sscanf parsing routine. Because a public proof-of-concept exists, a low-skill attacker can reliably crash the device or potentially achieve code execution on the router; given the network attack vector this can be performed remotely wherever the management interface is reachable.