Tenda M3 CVE-2025-15231

Exploitation requires network reachability to the device's HTTP management interface and a low-privilege authenticated session (CVSS PR:L), after which a single crafted request to /goform/setVlanInfo with an oversized ID, vlan, or port parameter triggers the overflow in formSetRemoteVlanInfo. Limiting factors: the attacker must be able to reach and authenticate to the admin web interface, so devices whose management plane is restricted to a trusted LAN/VLAN and that do not use default or shared credentials are substantially harder to exploit; no end-user interaction (UI:N) is needed. The affected build is specifically firmware 1.0.0.13(4903) of the Tenda M3.

This is a stack-based buffer overflow (CWE-119) in the formSetRemoteVlanInfo handler of the Tenda M3 device's /goform/setVlanInfo endpoint. Signals are mixed and point to moderate, not critical, real-world priority. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) yields 7.4 (High): network-reachable and low-complexity, but PR:L means the attacker must already be authenticated to the device, which materially reduces exposure versus a pre-auth flaw. Exploitation status is 'publicly available exploit code exists' (POC referenced on GitHub); it is NOT CISA KEV-listed and there is no evidence of active exploitation in the wild, so POC availability must not be conflated with real-world attacks. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. There is no SSVC decision record in the input. The CVE was reported by VulDB (cna@vuldb.com), a research/aggregator CNA, which is consistent with a researcher-disclosed embedded-device bug rather than a vendor-confirmed exploited threat. Net: a genuine, locally-authenticated RCE/DoS risk on an exposed management interface, but the PR:L requirement and absence of KEV/EPSS signals make it a 'patch in normal cycle' item rather than an emergency, unless the device's admin interface is exposed to untrusted networks or uses default credentials.

An attacker with access to the Tenda M3 web management interface (reachable over the network, authenticated at a low privilege level) sends a crafted request to /goform/setVlanInfo with an overlong ID, vlan, or port argument. This overflows a stack buffer in formSetRemoteVlanInfo, allowing device crash (DoS) or potential arbitrary code execution on the embedded Linux firmware. Public exploit documentation already exists on GitHub, lowering the effort required to reproduce.