Tenda AC20 CVE-2025-11385

Exploitation targets the HTTP endpoint /goform/fast_setting_wifi_set on Tenda AC20 firmware versions up to and including 16.03.08.12, by supplying an overlong timeZone parameter that overflows the sscanf-parsed buffer. Per the CVSS 4.0 vector the attack requires PR:L (low-privilege authentication to the router), and no user interaction. The principal limiting factor is reachability of the web management interface: on default deployments this is LAN-only, so WAN/internet exploitation requires management to be exposed to the network segment the attacker controls. The stated authentication requirement should be verified, as similar Tenda /goform setup handlers have historically been reachable without authentication.

This is a stack/memory buffer overflow (CWE-119) in the sscanf handling of the timeZone argument in /goform/fast_setting_wifi_set on the Tenda AC20 router. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) indicates network-reachable, low-complexity attack requiring low-level authentication, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists (VulDB/GitHub PoC, E:P in the vector), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread in-the-wild exploitation at this time. The signals are broadly consistent: the PoC and low attack complexity make exploitation technically easy, while the PR:L requirement and the fact that this is a consumer SOHO router (typically not Internet-exposed on its management interface by default) temper the real-world blast radius. Note a tension worth verifying: many Tenda /goform setup endpoints are historically reachable pre-authentication, yet the CNA-supplied vector asserts PR:L - the true authentication requirement should be confirmed against the firmware rather than assumed. Overall this is a genuine, PoC-backed device-compromise bug but not an emergency-tier internet-wide threat absent KEV/EPSS evidence.

An attacker with access to the router's web management interface (per the CVSS PR:L requirement) sends a crafted request to /goform/fast_setting_wifi_set with an oversized timeZone value, overflowing the buffer parsed by sscanf. Because low complexity and a public PoC exist, this can reliably crash the device or potentially lead to code execution on the router. Exploitation is network-based but practically constrained to attackers who can reach the management interface (LAN, or WAN only if management is exposed).