Tenda AC20 CVE-2025-14656

Exploitation targets the httpd web server's handler for /goform/openSchedWifi (the scheduled-Wi-Fi feature) on the Tenda AC20 running firmware 16.03.08.12, by supplying a malicious value in the schedStartTime or schedEndTime parameter. The supplied CVSS vector's PR:L implies a valid low-privilege authenticated session to the router's management interface is required, which limits exploitation to attackers who can reach that interface and have (or obtain) credentials; by default the web UI is bound to the LAN, so internet-facing exploitation depends on remote management being enabled or the device otherwise exposing its admin port. No special non-default feature beyond the schedule-Wi-Fi endpoint is indicated, and no user interaction is required (UI:N).

Signals are moderate and internally consistent. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity flaw that nonetheless requires low-privilege authentication (PR:L) and yields high confidentiality, integrity and availability impact on the device itself (no subsequent-system scope change). Exploitation status is 'publicly available exploit code exists' - a POC is referenced on GitHub, but there is NO CISA KEV listing and NO evidence of active exploitation, so POC availability must not be read as in-the-wild use. EPSS is low at 0.74% (53rd percentile), which is consistent with a niche consumer router that attracts automated-but-not-widespread probing rather than mass exploitation. The E:P (Proof-of-Concept) exploit-maturity marker in the vector agrees with the POC-but-not-KEV picture. Net: this is a credible but not top-tier priority - a genuine remote memory-corruption bug gated by authentication on a consumer SOHO device, not a high-CVSS-but-illusory issue, yet also not a drop-everything emergency absent exposure of the device's web interface to untrusted networks. Note the one tension to verify: the vector encodes PR:L (authenticated), while the terse VulDB description does not explicitly state an authentication prerequisite - defenders should confirm whether the /goform/openSchedWifi handler truly enforces a login before relying on authentication as a mitigating control.

An attacker with access to the Tenda AC20 web management interface (reachable over the network, holding a low-privilege session) sends a crafted request to /goform/openSchedWifi with an oversized or malformed schedStartTime or schedEndTime argument, overflowing a buffer in the httpd process. A public proof-of-concept exists, so weaponization effort is minimal; the overflow can crash the daemon or potentially achieve code execution on the router.