EUVD-2025-16922CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical remote buffer overflow vulnerability in Tenda AC18 router firmware version 15.03.05.05, affecting the reboot timer configuration function. An authenticated attacker can exploit improper input validation on the 'rebootTime' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, availability). Public exploit code exists and the vulnerability is actively exploitable with low attack complexity.
Technical Context
The vulnerability exists in the SetSysAutoRebbotCfg endpoint (/goform/SetSysAutoRebbotCfg), specifically within the formsetreboottimer function responsible for processing automatic reboot scheduling configuration. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow vulnerability. The affected product is a residential WiFi router (Tenda AC18) running firmware version 15.03.05.05. The vulnerable parameter 'rebootTime' lacks proper bounds checking before being written to a fixed-size buffer, allowing an attacker to overflow the buffer and overwrite adjacent memory including function return addresses or heap metadata. CPE identifier would be: cpe:2.3:o:tenda:ac18_firmware:15.03.05.05:*:*:*:*:*:*:*
Affected Products
AC18 WiFi Router (['15.03.05.05'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today