EUVD-2025-17426Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical remote buffer overflow vulnerability in Tenda AC7 wireless router firmware version 15.03.06.44, affecting the PPTP user list configuration function. An authenticated remote attacker can exploit this vulnerability to achieve arbitrary code execution with complete system compromise (confidentiality, integrity, and availability impact). Public exploit code has been disclosed and the vulnerability meets criteria for active exploitation risk.
Technical ContextAI
The vulnerability exists in the formSetPPTPUserList function within the /goform/setPptpUserList endpoint of the Tenda AC7 router's web management interface. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) buffer overflow, where user-supplied input in the 'list' parameter is not properly validated for length before being written to a fixed-size stack or heap buffer. The PPTP (Point-to-Point Tunneling Protocol) configuration feature processes the user list without adequate bounds checking. Affected CPE: cpe:2.3:o:tenda:ac7_firmware:15.03.06.44:*:*:*:*:*:*:*. The router's web interface handles administrative functions with minimal input sanitization, a common pattern in embedded device firmware.
RemediationAI
Immediate actions: (1) Identify all Tenda AC7 devices with firmware 15.03.06.44 on your network using device discovery or SNMP enumeration; (2) Consult Tenda's official firmware release page for patched versions (typically version numbers > 15.03.06.44); (3) Apply firmware updates via the router's web management interface (System Settings > Firmware Upgrade) or via Tenda's management application; (4) Workarounds if patch is unavailable: restrict network access to the /goform/setPptpUserList endpoint using firewall rules, disable the PPTP VPN feature if not in use (disable PPTP server in router configuration), and enforce strong administrator credentials (change default admin/admin credentials immediately); (5) Monitor router logs for suspicious POST requests to /goform/setPptpUserList endpoint; (6) Perform a factory reset and reconfigure with latest available firmware as a last resort if compromise is suspected.
Share
External POC / Exploit Code
Leaving vuln.today