Tenda AC7 CVE-2025-11527

Exploitation requires the attacker to reach the device's HTTP management interface and send a request to the /goform/fast_setting_pppoe_set endpoint (the PPPoE quick-setup handler) with an overlong 'Password' parameter. The supplied CVSS vector specifies PR:L, so a low level of privilege (e.g., an authenticated management session) is required - this is the primary limiting factor. Further limiting realistic exposure: only Tenda AC7 firmware 15.03.06.44 is confirmed affected, and consumer routers typically do not expose the web UI to the WAN by default, so practical attacks usually require LAN/management-plane access unless remote administration has been enabled.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity stack buffer overflow that requires low-level privileges (PR:L) and no user interaction, with high impact to confidentiality, integrity and availability but no scope change to adjacent systems (SC:N/SI:N/SA:N). Multiple signals are mixed: a public exploit exists (POC=YES) and the finding is credible, but the vulnerability is NOT in CISA KEV and the EPSS score is only 0.80% (55th percentile), meaning there is no evidence of widespread automated exploitation. The E:P (Proof-of-Concept exploit maturity) in the vector is consistent with the public PoC and reinforces that this is demonstrated-but-not-mass-exploited. Net assessment: this is a genuine, exploitable memory-corruption bug on an internet-of-things consumer router, but it is a moderate priority rather than an emergency - exploitation requires authenticated access (PR:L), it affects a single firmware build, and there is no KEV/active-exploitation signal. Prioritize patching/replacing exposed Tenda AC7 units where the web management interface is reachable by untrusted users, but it does not warrant the same urgency as a KEV-listed unauthenticated RCE.

An attacker with low-privilege access to the Tenda AC7 web management interface (e.g., a logged-in user, or an attacker who has reached the LAN/management plane) sends a crafted request to /goform/fast_setting_pppoe_set with an oversized 'Password' argument. This overflows a fixed-size stack buffer in the PPPoE fast-setup handler, corrupting the stack to crash the device or execute attacker-controlled code with the router's privileges. A public proof-of-concept for this exact endpoint is published on GitHub (noahze01/IoT-vulnerable).