Tenda AC15 CVE-2025-11388

Requires authenticated access (PR:L) to the Tenda AC15 HTTP web management interface and the ability to reach the /goform/setNotUpgrade endpoint over the network. Exploitation is performed by supplying an oversized 'newVersion' argument to that endpoint to overflow a stack buffer. Limiting factors: valid (low-privilege) credentials are needed, and the management interface must be network-reachable from the attacker - typically only severe when the web UI is exposed to the internet/WAN rather than LAN-only. In practice the authentication barrier is weakened on SOHO routers that retain default or weak credentials. No special non-default feature toggle is indicated by the description beyond access to the standard upgrade-related endpoint.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) describes a network-reachable, low-complexity stack buffer overflow requiring low-level privileges (PR:L) with full compromise of confidentiality, integrity, and availability on the device itself (no scope change: SC/SI/SA:N). The E:P value confirms only a proof-of-concept exploit maturity, consistent with the publicly available PoC on GitHub. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - this is 'publicly available exploit code exists', which is a distinct and weaker signal than in-the-wild exploitation. The PR:L requirement is the single most important mitigating factor: an attacker needs valid (even if low-privilege) credentials to the router's web interface, which meaningfully limits mass remote exploitation; however, SOHO devices frequently ship with weak or default credentials, eroding this barrier in practice. Net assessment: a genuine but moderate-priority issue - real exploit code against a consumer router, but gated by authentication and lacking any evidence of active exploitation. Prioritize patching/segmentation for internet-exposed management interfaces; deprioritize relative to unauthenticated KEV-listed flaws.

An attacker with low-privilege access to the Tenda AC15 web management interface (e.g., via default or guessed credentials on an exposed device) sends a crafted request to /goform/setNotUpgrade with an oversized newVersion argument. The overflow corrupts the stack and can crash the device or lead to arbitrary code execution on the router. A public proof-of-concept exploit for this exact endpoint is available on GitHub.