Ac6 Firmware CVE-2025-5854

CVSS 8.8 with AV:N (network-accessible) and AC:L (low complexity) indicates severe exploitability. However, PR:L (low privilege required—must be authenticated) significantly reduces attack surface compared to unauthenticated RCE. EPSS data is not provided, but public POC availability and disclosed exploit code elevate real-world risk substantially. The vulnerability qualifies for SSVC scoring as: Exploitation=Active (POC exists), Automatable=Yes (HTTP request-based), Technical Impact=Complete (RCE). This is a legitimate priority: while authentication is required, many routers have weak/default credentials, firmware exposure to LAN users, or compromised admin accounts. Router compromise enables lateral network movement, DNS hijacking, and persistent backdoors. The combination of public exploit, low complexity, and complete system compromise makes this a high-priority patch despite authentication gating.

A user on the same LAN or with network access to the router's management interface authenticates with default credentials (admin/admin) or via credential compromise. The attacker sends a crafted POST request to /goform/AdvSetLanip with an oversized lanMask parameter (e.g., a 512-byte string when the buffer expects <20 bytes). The buffer overflow overwrites the stack, corrupting the return pointer. By crafting the payload with shellcode or ROP gadgets, the attacker achieves arbitrary code execution as the httpd/root process. The compromised router can then be used to redirect DNS, intercept traffic, establish a persistent backdoor, or pivot to other network devices. Public POC code eliminates the need for manual exploit development, making this accessible to lower-skilled attackers once credentials are obtained.