Tenda M3 CVE-2025-15230

Exploitation requires sending a crafted request to the /goform/setVlanPolicyData endpoint that manipulates the qvlan_truck_port parameter processed by the formSetVlanPolicy function, triggering the heap overflow. Per the CVSS vector's PR:L, the attacker must hold low-level authentication to the router's web management interface; it is not unauthenticated. The practical limiting factor is reachability of that management interface - Tenda /goform interfaces are normally bound to the LAN, so meaningful remote exploitation presupposes LAN access or that remote administration has been explicitly enabled, despite the AV:N designation.

This is a heap-based buffer overflow (CWE-119) in the formSetVlanPolicy handler of the Tenda M3 router's web management interface. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring low-level authentication (PR:L) with high impact to confidentiality, integrity and availability but no scope change to subsequent systems. Publicly available exploit code exists (GitHub, dwBruijn), which raises practical risk above a theoretical finding, and this is reflected in the vector's E:P (Proof-of-Concept) exploit maturity. However, there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active, widespread exploitation - the signal is POC-availability, not in-the-wild use. A key tension: the vector asserts AV:N, yet Tenda /goform endpoints are typically exposed only on the LAN-side management interface, so true internet-facing remote exploitation depends on whether remote administration is enabled - verify actual exposure before treating this as remotely reachable. The PR:L requirement further limits risk to attackers who already possess (or can obtain default/weak) credentials. Net: a credible, POC-backed issue for the specific low-footprint consumer device, but not a mass-exploitation priority on the strength of the current signals.

An attacker with low-privilege access to the Tenda M3 web interface (or who has reached it on the LAN with valid/default credentials) sends a crafted request to /goform/setVlanPolicyData manipulating the qvlan_truck_port argument, overflowing a heap buffer in formSetVlanPolicy. A public proof-of-concept already exists, lowering the barrier to triggering memory corruption that can crash the device or potentially lead to code execution on the router.