Tenda M3 CVE-2025-15234

Requires network reachability to the device's HTTP management interface and at least low-privilege authentication (PR:L) to invoke the formSetRemoteInternetLanInfo handler at /goform/setInternetLanInfo. The specific trigger is supplying oversized/malformed values in the portIp, portMask, portGateWay, portDns, or portSecDns parameters of the remote internet/LAN configuration feature. Limiting factors: exploitation depends on the attacker being able to reach the web UI (typically LAN-side unless remote/WAN management is enabled) and on holding valid low-level credentials; it is confined to the affected firmware build 1.0.0.13(4903) on the Tenda M3. These conditions make broad unauthenticated internet-wide exploitation unlikely unless the management interface is exposed to the WAN.

Signals are moderately concerning but not top-tier. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-level privileges (PR:L), with high confidentiality, integrity, and availability impact on the vulnerable system and no scope change (SC/SI/SA:N). EPSS is 2.88% (86th percentile) - elevated relative to the average CVE but still a low absolute probability, indicating no broad automated exploitation observed. A public proof-of-concept exists (publicly available exploit code exists), which raises opportunistic risk, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, so there is no public exploit identified as actively exploited. The 'E:P' (Proof-of-Concept) in the CVSS vector is consistent with the POC signal. Net: this is a credible but second-tier priority - a POC-backed authenticated RCE/DoS in a consumer SOHO router. The PR:L requirement meaningfully limits mass exploitation versus a PR:N bug, so defenders should patch promptly on exposed devices but it is not a drop-everything emergency absent evidence of exploitation.

An attacker with low-level access to the device's web management interface sends a crafted request to /goform/setInternetLanInfo with oversized portIp/portMask/portGateWay/portDns/portSecDns values, triggering a heap-based buffer overflow in formSetRemoteInternetLanInfo. Because a public proof-of-concept is available, the barrier to reproduction is low and the overflow can crash the device or potentially lead to code execution. Exploitation is remote and low-complexity, but requires at least low-privilege authentication per the CVSS vector.