Tenda AC15 CVE-2025-11387

Exploitation requires network access to the Tenda AC15 web management interface and authenticated access at a low privilege level (PR:L), after which a request to the /goform/fast_setting_pppoe_set endpoint with an oversized 'Password' argument triggers the stack-based buffer overflow. Limiting factors: valid credentials or an active authenticated session are needed (not an unauthenticated drive-by), and risk is largely confined to devices whose management interface is reachable by the attacker - typically the LAN, or the WAN only if remote management is enabled. Scope is limited to this specific firmware version (15.03.05.18); no user interaction is required.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates a network-reachable, low-complexity flaw requiring low-level privileges (PR:L - i.e. authenticated) with high confidentiality, integrity, and availability impact on the vulnerable system and no scope change. The 'E:P' temporal metric (Proof-of-Concept) aligns with the stated publicly available exploit, meaning publicly available exploit code exists. However, this is NOT confirmed as actively exploited: there is no CISA KEV listing and no EPSS score was provided in the input, so real-world exploitation volume cannot be quantified from this data. The signals are internally consistent - a classic authenticated stack-based buffer overflow in a SOHO router web endpoint, credibly leading to code execution. Net assessment: a genuine high-severity issue for exposed/affected devices, but the PR:L requirement (valid credentials or an authenticated session to the router UI) meaningfully limits mass unauthenticated exploitation; priority should be driven by whether the management interface is internet-exposed and whether default/weak credentials are in use. No EPSS or KEV data is available to confirm widespread active exploitation - treat exploitation likelihood as inferred from POC availability only.

An attacker with access to the Tenda AC15 web management interface (e.g. via default or guessed credentials, or from the LAN) sends a crafted request to /goform/fast_setting_pppoe_set with an overlong Password argument, overflowing a stack buffer. Because low-complexity, authenticated network exploitation is indicated and public POC code exists (referenced on GitHub), a reliable crash or arbitrary code execution on the router is achievable with modest effort.