Tenda M3 CVE-2025-15232

Exploitation requires reaching the device's HTTP management service and submitting an authenticated request (PR:L) to the /goform/setAdPushInfo endpoint handled by formSetAdPushInfo, with an oversized value in the mac or terminal parameter to overflow the stack buffer. Limiting factors: valid low-privilege credentials or an authenticated session are needed, and the management interface must be reachable by the attacker - on default deployments this is LAN-side only, so network-wide (WAN) exploitation depends on remote administration being enabled.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires low-privilege authentication (PR:L), yielding a score of 7.4 with full confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) and no scope change (SC:N/SI:N/SA:N). The vector's E:P flag and the input's POC=YES confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. This is a genuine but second-tier priority: the PR:L requirement and the fact that Tenda web-management interfaces are normally LAN-facing substantially limit real-world reach, so it is more a device-hardening item than an internet-wide emergency. Note a mild tension - the vector marks AV:N, but for a SOHO router the management interface is typically only remotely exploitable if WAN-side administration is enabled; against default LAN-only exposure the practical attack surface is narrower than AV:N alone suggests.

An attacker with low-privilege access to the Tenda M3's web management interface sends a crafted POST to /goform/setAdPushInfo with an over-long mac or terminal argument, overflowing a stack buffer in formSetAdPushInfo. A public proof-of-concept exists (dwBruijn CVE writeup), so the request structure and offsets are documented, enabling denial of service and potentially arbitrary code execution on the device.