Ac10 Firmware CVE-2025-5629

This vulnerability presents a HIGH real-world risk despite the CVSS 8.8 score requiring authenticated access (PR:L). Risk factors: (1) CVSS vector AV:N/AC:L indicates network-accessible with low attack complexity once authenticated; (2) Public POC availability dramatically increases exploitation probability; (3) S:U/C:H/I:H/A:H indicates complete system compromise (confidentiality, integrity, availability all affected); (4) Tenda routers are consumer-grade devices often deployed with weak default credentials or unchanged admin passwords, reducing the practical barrier imposed by PR:L requirement; (5) Buffer overflows in network-exposed code are highly likely to be leverageable for remote code execution. The authentication requirement (PR:L) is a mitigating factor but should not be considered a strong control given the target device class. EPSS would likely be elevated due to public POC and remote network accessibility. This is a legitimate priority vulnerability, not just a high-CVSS-but-low-risk issue.

An attacker with valid credentials to the Tenda AC10 router's web interface (obtained via credential stuffing against default credentials, weak passwords, or phishing) sends a crafted HTTP POST request to /goform/SetPptpServerCfg with an oversized startIp or endIp parameter containing a carefully constructed buffer overflow payload (typically shellcode). The parameter is copied into a stack-allocated buffer without bounds checking, overflowing adjacent memory including the return address. The overflow payload redirects execution to attacker-controlled code, resulting in remote code execution with router privilege level. The attacker then gains full control of the router, potentially to: intercept/redirect traffic, establish persistent backdoor access, launch attacks on the internal network, or use the router as part of a botnet. The publicly available POC significantly reduces the bar for successful exploitation, requiring only script-kiddie level technical capability once valid credentials are obtained.