Tenda M3 CVE-2025-15233

Exploitation requires an authenticated session on the Tenda M3 web management interface (CVSS PR:L) and the ability to reach the /goform/setAdInfoDetail endpoint over the network. The attacker must submit an overized value in one of the specific advertising/SMS configuration parameters - adName, smsPassword, smsAccount, weixinAccount, weixinName, smsSignature, adRedirectUrl, adCopyRight, smsContent, or adItemUID - to trigger the heap overflow in formSetAdInfoDetails. Limiting factors: valid credentials are mandatory (no UI interaction beyond the request, UI:N), only firmware build 1.0.0.13(4903) is confirmed affected, and real-world risk is dominated by whether the admin interface is internet-exposed or protected only by default/weak credentials.

Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 4.0 base score of 7.4 reflects a network-reachable (AV:N), low-complexity (AC:L) heap overflow, but it explicitly requires low privileges (PR:L) - meaning the attacker must already be authenticated to the router's web management interface. A public exploit exists (E:P in the vector and an exploit reference on GitHub), which raises practical concern, yet the EPSS score is only 0.74% (53rd percentile), indicating no observed mass-exploitation trend. The CVE is NOT listed in CISA KEV, so there is no evidence of active in-the-wild exploitation. The PR:L requirement is the single most important mitigating factor: against an internet-exposed admin panel protected only by a weak/default password this is serious, but it is not an unauthenticated pre-auth RCE. SSVC-style reading: exploitation is 'POC' (public code, not active), technical impact is 'total' for the device (VC:H/VI:H/VA:H), and automatability is plausible but gated by the auth requirement. Net: treat as medium priority - elevate to high only for devices whose admin interface is network-exposed or uses default credentials.

An attacker who has authenticated to the Tenda M3 web interface (for example via default or weak credentials, or from an adjacent/LAN position) sends a crafted request to /goform/setAdInfoDetail with an oversized value in one of the vulnerable parameters (e.g. adName, smsContent, adRedirectUrl). This overflows a heap buffer in formSetAdInfoDetails, corrupting device memory to crash the service or potentially execute attacker-controlled code on the embedded device. A public proof-of-concept for this request is already available on GitHub.