Ac15 Firmware CVE-2025-5851

This vulnerability represents HIGH real-world risk across multiple intelligence dimensions: (1) CVSS 8.8 reflects critical severity with network-accessible attack vector (AV:N), low attack complexity (AC:L), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The requirement for low privilege (PR:L) indicates authenticated access is required, moderately limiting attack surface compared to unauthenticated exploits. (2) Public exploit disclosure significantly elevates EPSS exploitation probability; known POC availability removes research and weaponization barriers for attackers. (3) Automatable exploitation is likely given the HTTP POST interface and deterministic memory layout in embedded systems. (4) Technical impact is severe: remote code execution grants full device compromise, allowing botnet recruitment, network pivoting, or persistent backdoor installation. (5) For embedded device contexts, attack surface includes default credentials, local network access, or compromised administrative interfaces. The PR:L requirement is the primary limiting factor; however, many Tenda devices ship with default credentials or are deployed on networks where internal compromise is probable. This is NOT a false-positive high-CVSS issue—it represents genuine remote code execution risk with disclosed exploits.

An attacker with valid administrative credentials (obtained via credential brute-force, default credentials, or previous compromise) sends a specially crafted HTTP POST request to http://[router-ip]/goform/AdvSetLanip with an oversized lanMask parameter. The HTTP POST handler's fromadvsetlanip function copies the unterminated or unvalidated lanMask string into a fixed-size stack buffer without length checking. The buffer overflow overwrites the return address on the stack. Depending on heap/stack layout and ASLR presence, the attacker achieves code execution within the router's network daemon process, gaining root-level access. The attacker then installs a persistent backdoor, redirects DNS queries, performs man-in-the-middle attacks on network traffic, or recruits the device into a botnet. Public POC availability means exploitation requires only basic HTTP crafting knowledge—no advanced reverse engineering required. Attack complexity is low given the direct POST interface and deterministic embedded device memory layout.