EUVD-2025-16953CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical buffer overflow vulnerability exists in Tenda AC10 routers (versions up to 15.03.06.47) in the PPTP server configuration handler that allows authenticated remote attackers to execute arbitrary code or cause denial of service. The vulnerability affects the startIp/endIp parameters in the /goform/SetPptpServerCfg HTTP endpoint, requires valid credentials but no user interaction, and has publicly disclosed exploit code available, making it actively exploitable in real-world deployments.
Technical Context
The vulnerability exists in the HTTP request handler for PPTP (Point-to-Point Tunneling Protocol) server configuration on Tenda AC10 WiFi routers. The formSetPPTPServer function in /goform/SetPptpServerCfg fails to properly validate and bounds-check the startIp and endIp input parameters before copying them into a fixed-size buffer, resulting in a classic stack or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). PPTP is a legacy VPN tunneling protocol often configured via web administration interfaces on consumer-grade routers. The HTTP handler processes user-supplied IP address ranges without adequate input sanitization, allowing an attacker with valid HTTP authentication credentials to overflow adjacent memory and potentially redirect execution flow.
Affected Products
Tenda AC10 WiFi Router - All versions up to and including 15.03.06.47. The vulnerability is specific to the HTTP administrative interface and PPTP configuration functionality. CPE would map to: cpe:2.3:h:tenda:ac10:-:*:*:*:*:*:*:* with affected firmware versions cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:* (versions ≤15.03.06.47). The HTTP Handler component is built into the router's firmware and affects all deployed instances running vulnerable firmware versions.
Remediation
Immediate remediation: (1) Update Tenda AC10 router firmware to version 15.03.06.48 or later if available from Tenda; check Tenda's official firmware download page for AC10 updates; (2) If no patch is available, disable PPTP server functionality entirely via the router's web administration interface if VPN access is not required; (3) Restrict HTTP administrative access to the router to trusted networks only (limit WAN access to administration interface); (4) Change default/weak administrative credentials immediately; (5) Consider replacing the device with a more actively maintained router if Tenda does not provide a timely firmware patch. Contact Tenda support at their official channels for patch availability confirmation and timeline. Monitor Tenda security advisories for official patch release.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today