Is there a public PoC exploit available for CVE-2025-11523?

Yes, a public proof-of-concept exploit is available for CVE-2025-11523. Prioritise patching immediately. EPSS: 0.4%.

Tenda AC7 CVE-2025-11523

Q: What is the CVSS score of CVE-2025-11523?

CVE-2025-11523 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-09 cna@vuldb.com

Tenda Command Injection Ac7 Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:34 vuln.today

DescriptionCVE.org

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.

Technical ContextAI

The vulnerability resides in the web-based configuration interface of Tenda AC7 routers at the /goform/AdvSetLanip endpoint, which handles LAN IP address configuration. The lanIp parameter is processed without proper input validation or sanitization, allowing injection of shell metacharacters that are executed by the underlying system command interpreter. CWE-74 (Improper Neutralization of Special Elements in Output) indicates insufficient escaping of user-supplied data before passing it to a system command. The affected firmware version 15.03.06.44 (CPE:2.3:o:tenda:ac7_firmware:15.03.06.44) runs on embedded Linux systems typical of consumer-grade wireless routers.

RemediationAI

Upgrade Tenda AC7 firmware to a version released after 15.03.06.44 if available from Tenda's support portal (https://www.tenda.com.cn/). Check the Tenda AC7 product page or contact Tenda technical support to confirm patched firmware availability and compatibility. As an interim mitigation on unpatched devices: restrict network access to the router's web management interface by configuring firewall rules to limit access to the device management port (typically 80/443) from trusted administrative networks only, use strong non-default credentials for router admin login (this is essential given PR:L requirement), and disable remote management features if not needed. Note that these controls do not eliminate the vulnerability but reduce the window of exploit opportunity by limiting who can authenticate. No vendor patch version has been independently confirmed as available at the time of this analysis.