Rx3 Firmware CVE-2025-5527

The CVSS 3.1 score of 8.8 reflects a high-severity vulnerability with network-based attack vector (AV:N), low attack complexity (AC:L), but importantly requires low privilege (PR:L), indicating an authenticated attacker can exploit this remotely without administrative credentials. The impact is severe across all three dimensions (C:H/I:H/A:H), enabling complete system compromise. While EPSS data is not provided in this advisory, the combination of: (1) public POC availability, (2) authenticated (but not admin-level) access requirement, (3) straightforward buffer overflow mechanism, and (4) router as a high-value target suggests EPSS probability would be elevated (likely 0.70+). KEV status indicates active exploitation likelihood. The authentication requirement moderately reduces risk compared to unauthenticated RCE (typical AV:N/PR:N), but many router users share default or weak credentials, making this practically exploitable at scale. This is a legitimate priority requiring urgent patching.

An attacker with valid (non-admin) credentials to the Tenda RX3 web interface could craft a malicious HTTP POST request to /goform/SetStaticRouteCfg with an oversized 'list' parameter containing shell code or ROP gadget chains. The unvalidated parameter would overflow the stack buffer in save_staticroute_data, overwriting the function return address and executing arbitrary code with router system privileges. This could allow the attacker to: install persistent backdoors, modify routing rules for traffic interception, exfiltrate network traffic, or launch attacks against connected devices. In realistic scenarios, attackers could obtain valid credentials through default password exploitation, credential stuffing against leaked router credentials, or phishing. Public POC code accelerates exploitation at scale; expect rapid weaponization across botnets targeting IoT infrastructure.