What is the CVSS score of CVE-2025-15215?

CVE-2025-15215 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.7%.

Is there a public PoC exploit available for CVE-2025-15215?

Yes, a public proof-of-concept exploit is available for CVE-2025-15215. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2025-15215?

Within 24 hours, inventory all Tenda AC10U devices and confirm whether any are running firmware 15.03.06.48 or 15.03.06.49; immediately isolate them on a dedicated VLAN, block external access to the management interface and the /goform/setPptpUserList endpoint, disable remote administration and PPTP services if not required, and enable logging and monitoring for anomalous HTTP POST requests. Within 7 days, apply any vendor-provided workaround or updated firmware if it becomes available, restrict administrative access to trusted management networks, enforce strong authentication, and develop a migration plan for replacement hardware. Within 30 days, replace or decommission affected Tenda AC10U devices where feasible, verify that no unauthorized configuration changes or persistence mechanisms exist, and document the risk acceptance for any devices that cannot be immediately removed. Note that no vendor-released patch identified at time of analysis and publicly available exploit code exists.

Tenda AC10U CVE-2025-15215

HIGH

Buffer Overflow (CWE-119)

2025-12-30 cna@vuldb.com

Buffer Overflow Tenda Ac10U Firmware

7.4

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router HTTP interface
Delivery

Send POST to /goform/setPptpUserList
Exploit

Overflow buffer via oversized list argument
Execution

Corrupt memory / execute code
Impact

Full device compromise or DoS

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires network reachability to the Tenda AC10U web management HTTP server (typically LAN-side; WAN-side only if remote management is enabled) and the ability to send a POST request to /goform/setPptpUserList with an attacker-controlled, oversized 'list' parameter. The vendor vector specifies PR:L, implying a valid session/credential may be needed - though this endpoint class is often unauthenticated on Tenda devices, so the true auth requirement should be confirmed. Limited to firmware 15.03.06.48 and 15.03.06.49; no user interaction is required (UI:N).
Impact	This is a stack/memory buffer overflow (CWE-119) in the Tenda AC10U router firmware's web management interface, specifically the formSetPPTPUserList handler for /goform/setPptpUserList. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) indicates network-reachable, low-complexity exploitation requiring some privilege level (PR:L) with full compromise of confidentiality, integrity, and availability of the affected device. Publicly available exploit code exists (referenced via a Notion write-up tagged 'exploit' by NVD), which raises practical risk above a theoretical finding. However, EPSS is only 0.70% (51st percentile) and there is no CISA KEV listing, suggesting no evidence of widespread or automated exploitation to date - consistent with the pattern for the large volume of VulDB-reported SOHO router bugs, which are typically proof-of-concept crash/overflow demonstrations rather than mass-exploited campaigns. The PR:L assignment is worth verifying: many Tenda /goform/ endpoints are historically reachable without authentication, and if this endpoint is in fact unauthenticated the real severity would be higher (PR:N). Net: a credible, POC-backed device-takeover bug on a consumer router, but the limited deployment footprint and absence of KEV/high EPSS place it as a moderate priority rather than an emergency.
Exploit ScenarioDerived	An attacker with network access to the router's HTTP management interface sends a crafted POST request to /goform/setPptpUserList with an overlong 'list' argument, overflowing a fixed-size buffer in formSetPPTPUserList. This corrupts memory to crash the service or, with a tailored payload, execute code on the device. Public exploit/PoC material has been disclosed, lowering the bar for reproduction.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Tenda AC10U router firmware versions 15.03.06.48 and 15.03.06.49 contain a buffer overflow (CWE-119) in the formSetPPTPUserList handler for /goform/setPptpUserList, exploitable by sending an oversized 'list' parameter in an HTTP POST request. Successful exploitation can corrupt memory, potentially leading to remote code execution or device crash, with high impact on confidentiality, integrity, and availability. The CVSS vector indicates network attack (AV:N) with low attack complexity and privileges required (PR:L), though the endpoint is often unauthenticated on Tenda devices per independent assessment. Publicly available exploit code exists; no active exploitation in CISA KEV is confirmed. EPSS score is 0.70% (51st percentile).

RemediationAI

No vendor-released patch has been identified at time of analysis. Check Tenda's official support site (https://www.tenda.com.cn/) for firmware updates or security advisories. Until a patch is available, restrict access to the router's web management interface to trusted networks only-disable WAN-side remote management if enabled and ensure the LAN is not accessible to untrusted users. If the endpoint /goform/setPptpUserList is not needed, consider blocking or filtering POST requests to it at the network perimeter; however, this may break PPTP user configuration functionality. As a further compensating control, implement strict input validation if custom firmware or a reverse proxy is used to sanitize the 'list' parameter. Monitor VulDB (https://vuldb.com/?id.338600) for updates.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a classic buffer overflow (CWE-119) in the Tenda AC10U's web management interface, specifically the formSetPPTPUserList function that handles POST requests to /goform/setPptpUserList. This endpoint processes a user-supplied 'list' parameter to configure PPTP user entries. Due to improper bounds checking, an attacker can supply an oversized value that overflows a fixed-size memory buffer, corrupting adjacent stack or heap data. The affected firmware versions are 15.03.06.48 and 15.03.06.49 (CPE: cpe:2.3:o:tenda:ac10u_firmware:15.03.06.48 and cpe:2.3:o:tenda:ac10u_firmware:15.03.06.49). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both indicate that an attacker with network access and possibly authentication can fully compromise the device. The endpoint is part of the router's administrative interface, typically accessible on the LAN side.

Know when Ac10U Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

vuln.today AI 8.8 HIGH

Network-reachable web endpoint (AV:N), trivial overlong-argument trigger (AC:L); aligning with vendor PR:L for an authenticated management function; memory corruption yields full device C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive ViewAI

Why It Matters

Tenda AC10U routers running firmware 15.03.06.48 or 15.03.06.49 are affected by a high-severity memory corruption flaw that can enable remote code execution or cause device crashes. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, leaving organizations that rely on these devices for network edge or remote access functions exposed to potential unauthorized access, service disruption, and data compromise. Leadership should prioritize immediate compensating controls and plan for device replacement or isolation, because the affected devices may sit at trusted network boundaries.

Business Impact: High

Compensating Controls

Isolate affected Tenda AC10U devices on a dedicated VLAN; block external access to the management interface and /goform/setPptpUserList; disable remote administration and PPTP services if not required; enforce strong authentication; monitor for anomalous HTTP POST requests; and replace or upgrade devices when a vendor patch becomes available.

Threat Intelligence Overview

EPSS Score

0.7%

Top 49% exploitable

Prevalence

Low

niche consumer SOHO router model, specific firmware builds

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.7%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +37

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.