Tenda AC23 CVE-2025-15217

Requires network access to the Tenda AC23 (firmware 16.03.07.52) HTTP management interface and a low-privilege authenticated session (CVSS PR:L), after which the attacker submits a POST request to the formSetPPTPUserList endpoint of the HTTP POST Request Handler with a manipulated 'list' argument that overflows a memory buffer (CWE-119). Limiting factors: valid (even low-level) credentials are needed, so this is not a pure pre-auth flaw, and the web management interface is typically exposed only on the LAN by default - internet exploitability depends on remote management being enabled. No user interaction is required (UI:N).

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields a 7.4 (High), indicating a network-reachable, low-complexity attack that requires low-level privileges (PR:L) and no user interaction, with high confidentiality, integrity and availability impact on the device itself. The E:P flag in the vector and the explicit 'publicly available' POC (hosted on a Notion write-up linked from NVD) align - publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation. The realistic signals are therefore mixed: a working PoC lowers the barrier to opportunistic abuse, yet the PR:L requirement (the attacker must first be authenticated to the router's web UI) and the typical LAN-side exposure of SOHO router management interfaces materially constrain real-world impact. This reads as a genuine but moderate-priority issue for exposed Tenda AC23 devices rather than an internet-wide emergency; the authentication prerequisite is the key limiting factor that separates it from a wormable unauthenticated flaw. Note the reporter is cna@vuldb.com (VulDB), a research CNA that mass-publishes IoT/router flaws; there is no independent Tenda vendor advisory among the references (only the vendor homepage), so vendor confirmation and patch status are unverified.

An attacker with low-privilege access to the Tenda AC23 web management interface (e.g., a weak/default account or a user on the local network) sends a crafted HTTP POST request to the formSetPPTPUserList handler with an overly long or malformed 'list' argument. This overflows a fixed-size buffer in the request handler, corrupting memory to crash the service or achieve code execution on the router. A public proof-of-concept write-up already documents the exploitation steps, lowering the effort required.