Tenda AC6 CVE-2025-12225

Exploitation requires reaching the router's HTTP management interface and invoking the /goform/WifiGuestSet endpoint (the Wi-Fi guest network configuration handler) with an oversized value in the shareSpeed argument. Per the CVSS PR:L metric, the attacker must be authenticated to the web interface, so realistic exploitation depends on LAN access to the admin panel or possession of valid/default credentials. Limiting factors: this is specific to Tenda AC6 firmware 15.03.06.50; it is not demonstrated as fully unauthenticated; and exposure is normally confined to the local network unless remote administration is enabled, which meaningfully narrows the attack surface.

This is a stack-based buffer overflow (CWE-119) in the HTTP request handler of Tenda AC6 router firmware 15.03.06.50, reachable via the shareSpeed argument of /goform/WifiGuestSet. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L = authenticated) with high confidentiality, integrity, and availability impact and no scope change - base score 7.4. Signals are moderately aligned but not alarming: a public PoC exists (confirmed via the referenced GitHub exploit), yet the vulnerability is NOT listed in CISA KEV and there is no evidence of active exploitation. EPSS is low at 1.03% (63rd percentile), which despite a published PoC suggests exploitation remains theoretical/opportunistic rather than widespread in the wild. Two caveats to verify: (1) the CVSS marks PR:L, meaning the attacker must already be authenticated to the router's web interface, so 'remote' in the description realistically means LAN-adjacent or an attacker with valid/default credentials rather than fully unauthenticated internet exploitation - verify exposure of the admin interface; (2) this is a VulDB/CNA-sourced report (cna@vuldb.com) with no corroborating Tenda vendor advisory, so affected-version and patch data are single-sourced. Net assessment: a legitimate device-compromise flaw with working exploit code, but the authentication requirement and low EPSS place it below drop-everything priority absent exposed management interfaces.

An attacker with access to the router's web management interface (e.g., on the LAN, or using default/weak credentials) sends a crafted HTTP request to /goform/WifiGuestSet with an oversized shareSpeed value, overflowing a stack buffer. Given AV:N/AC:L and the published PoC (GitHub BinaryAudit WifiGuestSet writeup), this reliably crashes the HTTP daemon and may be developed into arbitrary code execution on the device, yielding full control of the router.