Tenda AC15 CVE-2025-11386

Exploitation targets the DDNS configuration endpoint /goform/SetDDNSCfg of the Tenda AC15 (firmware 15.03.05.18) and is triggered by manipulating the ddnsEn POST parameter to overflow a stack buffer. Per the CVSS vector it requires network reachability to the HTTP management interface and LOW-privilege authentication (PR:L) - i.e., the attacker must be able to log in to the router's web UI - with no user interaction. Limiting factors: the attacker must reach the management interface (typically LAN-side or an exposed/remote-management-enabled WAN interface) and hold valid low-level credentials, and only this specific firmware version is confirmed affected.

Signals are moderately consistent but point to a contained rather than mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC/VI/VA:H, base 7.4) describes a network-reachable, low-complexity flaw that requires low-privilege authentication (PR:L) and yields full compromise of the device. Public exploit code exists (GitHub PoC by noahze01), which raises practical risk, but the CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation - PoC availability and active exploitation are distinct signals. The exploitation status is therefore 'publicly available exploit code exists.' No SSVC decision or EPSS probability was supplied, so automatability and real-world exploitation likelihood cannot be derived from the input. Net: a genuinely serious device-takeover bug on an affected router, but the PR:L requirement (an attacker must reach and authenticate to the web management interface) and absence of KEV/EPSS data argue this is a targeted/LAN-adjacent concern rather than a drive-by internet-wide emergency. Note the data is thin - only a VulDB submission and a PoC link, no vendor advisory or patch, so affected-version and fix data are unconfirmed.

An attacker with access to the Tenda AC15 web management interface and low-privilege credentials sends a crafted POST request to /goform/SetDDNSCfg with an oversized ddnsEn argument, overflowing a stack buffer. Public exploit code for this exact endpoint is available on GitHub, lowering the skill barrier. Successful exploitation corrupts the stack to crash the service or execute attacker-controlled code on the router, enabling full device compromise.