Tenda AC15 CVE-2025-11389

Requires low-privilege authenticated access (PR:L) to the Tenda AC15 web management interface, which must be network-reachable to the attacker; exploitation targets the specific endpoint /goform/saveAutoQos via the 'enable' argument. The confirmed affected build is firmware 15.03.05.18. Limiting factors: the attacker needs valid (even if low-privilege) credentials to the web UI and network access to it - exposure is greatly increased when the management interface is internet-facing or when default/weak credentials are left in place, and is limited to this firmware version on the AC15 model. No user interaction is required once access is obtained.

This is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) - consistent with a stack-based buffer overflow (CWE-119) that can crash the device or achieve code execution. Exploit maturity is flagged as Proof-of-Concept (E:P), and a public exploit write-up is confirmed, so the barrier to weaponization is low. However, the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation yet - the signals indicate capability and public availability rather than observed campaigns. The key mitigating signal is PR:L: exploitation requires authenticated access to the router's web interface, which tempers the raw network-reachability. Note this is a consumer/SOHO router, so real-world exposure depends heavily on whether the management interface is reachable from untrusted networks and whether default credentials are in use. Overall: a credible, publicly-exploitable flaw worth patching on affected devices, but current data does not support treating it as an urgent in-the-wild emergency.

An attacker with low-privilege access to a Tenda AC15 router's web management interface (e.g., via default or weak credentials, or a foothold on the LAN) sends a crafted request to /goform/saveAutoQos with an oversized or malformed 'enable' argument. This overflows a stack buffer, crashing the device or potentially executing attacker-controlled code with the web service's privileges. A public proof-of-concept exists, lowering the effort required to reproduce the attack.