Ac5 Firmware CVE-2025-5795

HIGH REAL-WORLD RISK. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible flaw requiring only low-privilege authentication (PR:L), no user interaction, and complete system compromise potential. The low AC:L rating indicates straightforward exploitation without complex environmental factors. Public PoC availability dramatically increases real-world exploitation probability. However, the PR:L requirement (authenticated access needed) slightly reduces risk compared to unauthenticated flaws—but many Tenda routers ship with default credentials or weak authentication. The SSVC exploitation status should be marked as 'active' given public PoC disclosure. This is NOT a low-real-risk-high-CVSS issue; the attack vector (network), low complexity, and automatable exploitation combine with high technical impact to create significant enterprise and consumer risk, particularly for networks with compromised or default router credentials.

An attacker with valid router credentials (obtained via credential stuffing, default credentials, or phishing) connects to the Tenda AC5 web management interface. The attacker crafts a malicious HTTP POST request to /goform/AdvSetLanip with an oversized lanMask parameter (e.g., >256 bytes of crafted payload including ROP gadgets or shellcode). The improper bounds checking allows the buffer overflow to overwrite stack memory, corrupting the return address. The attacker redirects execution to arbitrary code, typically injected within the lanMask payload or from existing firmware gadgets. Successful exploitation grants remote code execution (RCE) with router privileges, enabling the attacker to: modify firewall rules, intercept traffic, establish persistent backdoors, or pivot to internal network devices. Public PoC reduces time-to-weaponization. Automated scanning tools can identify vulnerable Tenda AC5 instances; exploitation is automatable and likely integrated into botnet frameworks targeting IoT/router infrastructure.