Ac15 Firmware CVE-2025-5850

This vulnerability presents HIGH real-world risk despite requiring authenticated access (CVSS PR:L). Risk signals align strongly: (1) CVSS 8.8 with network-exploitable vector (AV:N), low complexity (AC:L), and complete system impact (C:H/I:H/A:H); (2) Public POC availability significantly increases exploitation likelihood and reduces attacker technical barriers; (3) The requirement for low privilege authentication (PR:L) is not a strong mitigation—many organizations fail to change default router credentials or restrict admin access; (4) Routers are persistent network infrastructure targets; (5) Buffer overflows can enable remote code execution with router-level privileges. EPSS would likely score high (0.85+) given public POC and network exposure. This is NOT a low-real-risk-despite-high-CVSS situation—it represents genuine critical infrastructure compromise risk for affected deployments. The automatable nature of exploitation (POST request with crafted Time parameter) further increases priority.

An attacker with network access to an affected Tenda AC15 router (e.g., through compromised WiFi credentials or default credentials) authenticates to the web management interface. The attacker crafts an HTTP POST request to /goform/SetLEDCf with a maliciously long 'Time' parameter value exceeding the allocated buffer size. The buffer overflow overwrites adjacent memory, potentially corrupting the stack or heap to achieve arbitrary code execution with router privileges. With publicly available POC code, this requires minimal technical skill. The attacker could then establish persistence, exfiltrate network traffic, pivot to internal network resources, or use the router as a botnet node. Attack complexity is low (AC:L) due to straightforward HTTP POST manipulation, and no user interaction is required (UI:N).