Tenda W6-S CVE-2025-15254

Exploitation requires network access to the Tenda W6-S router's HTTP management interface (the /goform/ate endpoint must be reachable) and low-privilege authentication - PR:L in the CVSS 4.0 vector confirms some credentials are required, though whether these are standard admin credentials or a lower-privilege session (such as guest access) is not specified in available data. The attack vector is AV:N with AC:L and AT:N, meaning no special network positioning, no complex attack conditions, and no attack-specific prerequisites beyond authentication. Exploitation is limited to devices running firmware version 1.0.0.4(510) specifically; other firmware versions are neither confirmed vulnerable nor confirmed safe. The attack surface is further limited by whether the management interface is exposed to untrusted networks - devices with management restricted to LAN-only are harder to reach but not immune if an attacker has LAN access or valid credentials.

There is a notable signal conflict in this CVE that security teams should scrutinize. The official CVSS 4.0 score of 2.1 reflects VC:L/VI:L/VA:L - low impact across all three dimensions - which is inconsistent with the nature of CWE-77 OS command injection, which canonically implies arbitrary code execution and therefore HIGH confidentiality, integrity, and availability impact on the vulnerable system. This discrepancy likely reflects understated scoring by the reporter (VulDB/CNA) rather than a genuinely limited-scope injection. Independent assessment places the real-world impact significantly higher. EPSS at 76th percentile with a public POC on GitHub (dwBruijn/CVEs) confirms that exploitation tooling is accessible, though the 0.90% absolute probability and absence from CISA KEV indicate no observed mass exploitation. The network attack vector (AV:N) with low privilege (PR:L) and no user interaction makes this remotely triggerable by any authenticated user on the device, including default or guest credentials if those exist. The attack surface is bounded to environments where the Tenda W6-S is deployed and its management interface is network-accessible. Consumer router deployments often have weak credential hygiene, amplifying practical risk. No vendor advisory or patch has been identified from the Tenda website reference.

An attacker with low-privilege credentials (or default credentials) to the Tenda W6-S management interface sends a crafted HTTP POST request to /goform/ate with shell metacharacters embedded in the function parameters accepted by TendaAte, injecting an arbitrary command such as a reverse shell or credential dump. Because the public POC at https://github.com/dwBruijn/CVEs/blob/main/Tenda/ate.md demonstrates this technique, exploitation requires minimal skill. On a network where the management interface is accessible, this can be triggered remotely without physical access to the device.