Tenda AC10U CVE-2025-15218

Exploitation requires the attacker to reach the device's web management endpoint /goform/AdvSetLanip and submit a POST request manipulating the lanMask parameter handled by fromadvsetlanip. The CVSS 4.0 vector specifies PR:L, meaning low-privilege authentication to the router interface is required - this is not a fully unauthenticated flaw. The primary limiting factor is exposure of the management interface: on default configurations this interface is typically bound to the LAN, so the realistic attacker is one already on the local network (or past the login) rather than an arbitrary internet host unless the admin UI is deliberately exposed to the WAN. Affected scope is limited to Tenda AC10U firmware 15.03.06.48 and 15.03.06.49.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity buffer overflow requiring low-level privileges (PR:L), yielding a base score of 7.4. A public exploit exists (confirmed via the Notion write-up referenced by NVD), which is reflected in the vector's E:P (Proof-of-Concept) maturity. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active, widespread exploitation - the signal here is POC availability, not in-the-wild use. These signals are consistent rather than conflicting: a disclosed consumer-router overflow with public POC but no KEV typically reflects commodity IoT research (this was reported by VulDB, cna@vuldb.com) rather than a targeted campaign. One point to verify: PR:L implies the attacker must first authenticate to the router's web interface, so real-world risk is meaningfully lower for devices not exposing their management UI to untrusted networks; on default LAN-only deployments the practical attacker is someone already on the local network or past the login. No EPSS value is present, so exploitation probability cannot be quantified from this data.

An attacker with access to the router's web management interface (or valid/low-privilege credentials) sends a crafted POST request to /goform/AdvSetLanip with an oversized or malformed lanMask argument, overflowing a buffer in the fromadvsetlanip handler. A public proof-of-concept is available, lowering the skill barrier; given the low attack complexity, a successful overflow can crash the device (denial of service) or potentially achieve code execution on the router.