Tenda AC7 CVE-2025-11528

Exploitation requires reaching the router's HTTP management interface and sending a manipulated 'enable' parameter to the /goform/saveAutoQos (Auto QoS save) endpoint. Per the CVSS vector (PR:L), the attacker needs low-privilege authenticated access to that web interface - not anonymous access - so valid or default credentials are a prerequisite. The practical limiting factor is reachability: the management interface is typically exposed only on the LAN unless WAN/remote management is enabled, which narrows realistic exposure to local attackers or devices with remote administration turned on.

This is a moderate-priority vulnerability whose real-world risk is tempered by its access requirements. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.4 and indicates a network-reachable, low-complexity attack that nevertheless requires low-level privileges (PR:L) - i.e. an authenticated session on the router's management interface, not fully anonymous access. Impact is severe where it applies (VC:H/VI:H/VA:H), consistent with a stack-based buffer overflow (CWE-119) that can lead to code execution or device crash. Publicly available exploit code exists (referenced PoC on GitHub), but there is no CISA KEV listing, and the EPSS score is low at 0.80% (55th percentile), indicating no evidence of widespread automated exploitation at this time. The signals are therefore consistent rather than conflicting: a real but not emergency-grade issue - a working PoC against a consumer router, gated by authentication and (typically) LAN reachability. Note the AV:N classification assumes the HTTP management interface is network-reachable; on most deployments it is LAN-only unless remote/WAN management is explicitly enabled, which should be verified per deployment. Treat this as a prioritized patch for exposed or remotely-managed devices, not a drop-everything critical.

An attacker with low-privilege access to the Tenda AC7 web management interface (e.g. via default or weak credentials, or an already-compromised LAN foothold) sends a crafted HTTP request to /goform/saveAutoQos with an oversized or malformed 'enable' argument. This overflows a stack buffer in the request handler, enabling denial of service or arbitrary code execution on the router. A public proof-of-concept for this endpoint is available on GitHub, lowering the barrier to reproduction.