Tenda AC10 CVE-2025-67073

Exploitation requires network reachability to the router's HTTP administration service (bin/httpd) and the ability to send an unauthenticated POST request to the specific endpoint /goform/AdvSetMacMtuWan with an overlong serviceName parameter. The limiting factor is exposure of that admin interface: on default Tenda AC10 V4.0 (firmware V16.03.10.20) deployments the web UI is bound to the LAN, so internet-based unauthenticated attack generally requires the WAN/remote-management interface to be enabled - otherwise the attacker must be on the local network segment. Denial of service is the confirmed outcome; arbitrary code execution is conditional on exploitability of the overflow (memory layout, lack of mitigations) and is described only as possible. Specific to this one firmware build; other versions not confirmed affected.

All quantitative signals point to high severity but with important caveats on real-world reach. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full CIA impact. A public exploit is referenced (johnathanhuutri/CVEReport on GitHub), raising the practical likelihood of opportunistic use. However, the vulnerability is NOT listed in CISA KEV and no EPSS score was supplied, so there is no evidence of confirmed active exploitation - this is POC availability, not in-the-wild exploitation, and the two must not be conflated. The description itself tempers the CVSS impact: it states denial of service is achievable and code execution is only 'possibly' achievable (classic CWE-120 stack/buffer overflow where reliable RCE often depends on memory layout and mitigations), so the C:H/I:H part of the 9.8 is partly aspirational for this specific bug. Most significant qualifier: the affected component is the web administration daemon (bin/httpd) of a consumer SOHO router, which on default Tenda configurations is typically bound to the LAN interface - true unauthenticated exploitation from the internet generally requires the remote-management/WAN admin interface to be enabled, otherwise the attacker must already be LAN-adjacent. Net assessment: a genuine high-severity, easily triggered flaw worth patching promptly for exposed devices, but the 9.8 overstates mass-internet risk because real exploitation is gated by network exposure of the admin interface and reliable RCE is unconfirmed.

An attacker with reachability to the router's web management interface (LAN-adjacent, or internet-facing where remote administration is enabled) sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an oversized serviceName field, overflowing a buffer in the fromAdvSetMacMtuWan function of httpd. This reliably crashes the daemon (denial of service) and may allow execution of attacker-supplied code on the device. Public proof-of-concept code is available, lowering the barrier to reproduction.