EUVD-2025-17416CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in Tenda AC6 router firmware version 15.03.05.16, affecting the PPTP user list configuration function accessible via the /goform/setPptpUserList endpoint. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'list' argument to achieve code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the vulnerability meets criteria for active exploitation risk.
Technical Context
This vulnerability exists in the formSetPPTPUserList function within the web management interface of Tenda AC6 routers, which handles Point-to-Point Tunneling Protocol (PPTP) user account configuration. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack or heap buffer overflow. The vulnerable parameter 'list' lacks proper bounds checking when processing user input, allowing an attacker to write arbitrary data beyond allocated buffer boundaries. This affects Tenda AC6 CPE cpe:2.3:o:tenda:ac6_firmware:15.03.05.16:*:*:*:*:*:*:*. The web-based administration interface is the attack vector, requiring Layer 7 HTTP request manipulation.
Affected Products
AC6 (['15.03.05.16'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today