Tenda AC18 CVE-2025-14992

Exploitation requires HTTP access to the Tenda AC18 web management interface and a successful request to the /goform/GetParentControlInfo endpoint of the HTTP Request Handler, supplying an overlong value in the 'mac' argument to overflow the stack buffer in strcpy. The CVSS vector specifies PR:L, so at least low-privilege authenticated access to the router is required (not a fully unauthenticated attack), and exploitation is constrained to the specific affected firmware build 15.03.05.05 on the Tenda AC18. No user interaction is needed (UI:N). The practical limiting factor is reachability of the management interface - typically exposed only on the LAN unless remote administration is enabled - combined with the authentication prerequisite.

Signals are moderate and internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality/integrity/availability impact and no scope change yields the reported 7.4 base score; the PR:L requirement means an attacker needs at least low-level authenticated access (a valid session/credentials to the router web interface), which materially limits mass exploitation despite the network attack vector. Exploitation maturity is flagged as E:P (Proof-of-Concept), consistent with the publicly available PoC and the absence of CISA KEV listing. EPSS is low at 0.74% (54th percentile), which - combined with the authentication prerequisite and lack of KEV - indicates this is NOT currently a top-priority widespread-exploitation threat, but rather a credible, publicly-documented flaw suitable for targeted use against reachable, authenticated-accessible Tenda AC18 devices. Conflict to note: the PoC and classic Tenda /goform patterns suggest trivial exploitation, yet CVSS assigns PR:L rather than PR:N - if the GetParentControlInfo endpoint is in fact reachable pre-authentication (common on these consumer routers), real-world risk would be higher than the 7.4 implies; verify the authentication requirement against the vendor firmware.

An attacker with network reachability to the Tenda AC18 web/HTTP management interface and at least low-privilege access sends a crafted HTTP request to /goform/GetParentControlInfo with an oversized 'mac' argument. The unsafe strcpy overflows a stack buffer, allowing denial of service or arbitrary code execution on the router (MIPS/ARM firmware). A public proof-of-concept is already available (github.com/z472421519/BinaryAudit), lowering the barrier to reproduction.