Tenda AC7 CVE-2025-11524

Exploitation requires reaching the Tenda AC7 web management HTTP interface and invoking the /goform/SetDDNSCfg handler with a crafted ddnsEn parameter; per CVSS PR:L, authenticated access to that management interface is required, so the attacker needs valid (even low-privilege) credentials or an already-authenticated session. Limiting factors: the management interface on SOHO routers is typically bound to the LAN by default rather than the WAN, so remote exploitation across the internet depends on the router being configured for remote/WAN management or the attacker being LAN-adjacent; it is specific to firmware 15.03.06.44 (and any other affected versions not enumerated). No end-user interaction (UI:N) is needed, and attack complexity is low (AC:L/AT:N).

This is a stack-based buffer overflow (CWE-119) in the Tenda AC7 consumer router firmware 15.03.06.44, reachable via the /goform/SetDDNSCfg endpoint through the ddnsEn argument. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L = authenticated), with high confidentiality, integrity, and availability impact confined to the vulnerable device (no scope change). A public exploit exists (GitHub PoC by noahze01), which materially raises practical risk, but EPSS is only 1.03% (63rd percentile) and the CVE is NOT in CISA KEV - so there is publicly available exploit code but no confirmed active exploitation. Signals are broadly consistent rather than conflicting: a network-facing SOHO router flaw with a published PoC but modest EPSS and no KEV listing. The main caveat is the PR:L requirement - exploitation presupposes access to the router's authenticated web management interface (typically LAN-side or an attacker with credentials), which meaningfully constrains real-world mass exploitation compared to a PR:N flaw. Also note this was reported by VulDB (cna@vuldb.com) for an older firmware on a low-cost consumer device; treat it as a genuine but not top-tier priority unless the affected device is internet-exposed.

An attacker with access to the router's authenticated web management interface sends a crafted HTTP request to /goform/SetDDNSCfg with an oversized or malformed ddnsEn value, overflowing a stack buffer in the DDNS configuration handler. A public proof-of-concept exists (noahze01 IoT-vulnerable repo), so exploitation is low-complexity; given the network attack vector, this can be triggered remotely against the device's management interface to crash the service or potentially execute code.