Tenda AC23 CVE-2025-15216

Requires network access to the Tenda AC23 (firmware 16.03.07.52) HTTP management interface and the ability to invoke /goform/SetIpMacBind (the IP-MAC binding feature), with a crafted/oversized bindnum parameter. The CVSS vector's PR:L indicates authenticated access to the web UI is needed, so exploitation is limited to attackers who hold valid management credentials or can reach an interface protected by default/weak credentials; the primary limiting factors are management-plane exposure (LAN vs. WAN-reachable admin) and the low deployment footprint of this specific router model. No user interaction is required (UI:N).

Signals are moderately aligned toward a real but bounded risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity flaw requiring only low-level privileges (PR:L) with full confidentiality/integrity/availability impact on the vulnerable device. Exploitation status is 'publicly available exploit code exists' (POC referenced on an external Notion page), which raises practical risk above a theoretical bug, but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active, widespread exploitation - POC availability must not be conflated with in-the-wild use. The PR:L requirement is a meaningful limiter: an attacker needs valid access to the router's web management interface, so the realistic threat is strongest where the admin interface is exposed to untrusted networks or protected only by default/weak credentials. Note a data gap: no CVSS 3.1 vector was provided (only 4.0), and the vendor (tenda.com.cn reference) has no linked advisory or patch, so fix availability is unconfirmed. Net: a genuine high-severity device-takeover bug on affected hardware, but its blast radius depends on exposure of the management plane and the low real-world deployment footprint of this specific router model rather than indicating a mass-exploitation priority.

An attacker with access to the router's web management interface (or who reaches it across an exposed/adjacent network) sends a crafted request to /goform/SetIpMacBind with an oversized or malformed bindnum argument, overflowing a stack buffer in fromSetIpMacBind. A public proof-of-concept exists, lowering the skill barrier; given AC:L the overflow is reliably triggerable and can crash the device or lead to arbitrary code execution on the router.