Tenda AC7 CVE-2025-11525

Exploitation requires network access to the Tenda AC7 web management interface and a low-privilege authenticated session (CVSS PR:L), after which the attacker submits a request to the /goform/SetUpnpCfg endpoint with a malicious upnpEn parameter value to trigger the stack overflow. Limiting factors: the device's HTTP management interface must be reachable by the attacker (typically LAN-side by default on consumer routers, significantly limiting internet-wide exploitation unless remote administration is enabled/exposed), and some level of authentication is needed rather than fully unauthenticated access. No special non-default product feature beyond UPnP configuration handling is implicated; the condition is simply reaching and authenticating to the admin endpoint on firmware 15.03.06.44.

Multiple signals converge on a moderate-but-real risk profile. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity flaw requiring low-level privileges (PR:L = authenticated) with high impact to confidentiality, integrity, and availability - consistent with a stack-based buffer overflow (CWE-119) enabling likely remote code execution on the device. Public exploit code exists (GitHub PoC by noahze01), which raises practical exploitability, but the flaw is NOT in CISA KEV and there is no confirmation of active exploitation. EPSS is modest at 1.03% (63rd percentile), suggesting no observed mass exploitation despite public PoC availability - a common pattern for SOHO router CVEs that are technically exploitable but not yet mechanized at scale. The key tension: a PoC lowers the bar for opportunistic attackers, yet the PR:L requirement means an attacker needs some authenticated access to the router's web interface, which constrains purely unauthenticated internet-wide exploitation and is reflected in the low EPSS. This is a genuine priority for anyone operating the affected Tenda AC7 firmware (especially if the management interface is reachable from untrusted networks), but it is not a drop-everything internet-wide emergency. Note: the SSVC framework and automatable/technical-impact fields were not provided in the input, so an SSVC-based priority cannot be independently derived here.

An attacker with access to the router's web management interface (e.g., an authenticated LAN user, or via a reachable/exposed admin interface) sends a crafted HTTP request to /goform/SetUpnpCfg with an oversized or malformed upnpEn argument, overflowing a stack buffer. This corrupts the saved return address and can lead to arbitrary code execution on the router. A public proof-of-concept is available on GitHub, lowering the effort required to reproduce the attack.