Tenda AC10 CVE-2025-67074

Exploitation requires the attacker to reach the router's HTTP management service (bin/httpd) and POST to /goform/AdvSetMacMtuWan with an overlong 'serverName' field; the vulnerable code path is the WAN MAC/MTU advanced-setting handler fromAdvSetMacMtuWan. Per CVSS PR:N, no authentication is required. The primary LIMITING factor is AV:A (Adjacent): the attacker must be on the same local network segment (e.g., connected to the LAN or Wi-Fi), so this is not exploitable from the public internet unless the management interface is deliberately exposed to the WAN side. It is further limited to the specific affected build Tenda AC10 (AC10V4.0) firmware V16.03.10.20; confirmed impact is a crash/DoS of the httpd service rather than verified code execution.

This is a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) tells the real story better than the 'RCE' tag: the only confirmed impact is availability (A:H) - i.e. a denial of service by crashing the bin/httpd process - and the attack vector is Adjacent (AV:A), meaning the attacker must already be on the same local/Wi-Fi/LAN segment, not the open internet. The description's 'possibly code execution' is speculative and is NOT reflected in the confidentiality/integrity metrics (both N), so treating this as reliable remote code execution would overstate it - CONFLICT: the 'RCE' tag and 'possibly code execution' wording versus C:N/I:N in the CVSS vector; verify any code-execution claim before prioritizing as RCE. Supporting signals are weak-to-moderate: a public PoC exists (raising practical exploitability for anyone with LAN access), but EPSS is only 0.38% (30th percentile), indicating low modeled probability of widespread exploitation, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. No SSVC decision data was supplied. Net: a credible LAN-local DoS against a specific consumer router firmware with public exploit code, but low real-world urgency for most defenders given the adjacent-only vector and absence of confirmed exploitation or confirmed code execution.

An attacker who has already joined the target's local network - for example via the router's Wi-Fi or a wired LAN port - sends a single crafted HTTP POST to /goform/AdvSetMacMtuWan with an oversized 'serverName' field, overflowing a stack buffer in the fromAdvSetMacMtuWan handler of bin/httpd. This crashes the web/management service (denial of service) and, per the report, could potentially lead to code execution, though only the DoS impact is confirmed by the CVSS metrics. A public proof-of-concept is available, lowering the skill required to reproduce the crash.