Tenda AC7 CVE-2025-11586

Exploitation requires network access to the Tenda AC7's HTTP management interface and the ability to invoke the /goform/setNotUpgrade endpoint with a controlled newVersion argument. Per the supplied CVSS vector (PR:L), authenticated access to the router's web UI is required, which limits exploitation to attackers who have valid credentials or who are positioned on the LAN/management network; it is not stated to be exploitable against a default configuration without authentication. The primary limiting factors are this authentication requirement and the fact that router management interfaces are typically LAN-facing rather than WAN-exposed by default - note, however, that the PR:L assumption is CNA-assigned and should be confirmed, since many Tenda /goform handlers have historically been reachable without authentication.

This is a stack-based buffer overflow (CWE-119) in the Tenda AC7 consumer router firmware 15.03.06.44, reachable over the network via the /goform/setNotUpgrade endpoint through the newVersion parameter. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates network-reachable, low-complexity exploitation that nonetheless requires some privilege level (PR:L, i.e. authenticated), with high impact to confidentiality, integrity and availability but no scope/subsequent-system change. A public exploit exists (confirmed by the GitHub PoC reference and VulDB), but there is no CISA KEV listing and the EPSS score is low at 0.87% (57th percentile), so there is no evidence of widespread automated exploitation at this time. The signals are broadly consistent: a real, disclosed, PoC-backed flaw of genuine technical severity, but the PR:L authentication requirement plus the low EPSS and absence of KEV temper real-world urgency - this is a real issue to patch, not a mass-exploitation emergency. One caveat: VulDB-sourced Tenda IoT reports frequently assign network vector with debatable authentication assumptions; whether /goform/setNotUpgrade truly requires valid credentials (PR:L) or is reachable pre-auth should be verified against the PoC, as that materially changes the risk.

An attacker with network reachability to the router's web management interface sends a crafted request to /goform/setNotUpgrade with an oversized newVersion argument, overflowing a stack buffer in the handler. This can crash the service (denial of service) or, with a tuned payload, hijack control flow to execute attacker-controlled code on the device. A public proof-of-concept for this exact endpoint is available on GitHub, lowering the effort to reproduce.