Ac1206 Firmware CVE-2025-7544

This vulnerability presents very high real-world risk despite requiring low-privilege authentication. Key risk signals: (1) CVSS 8.8 with network-accessible attack vector (AV:N), low complexity (AC:L), and high impact across all three security dimensions (C:H/I:H/A:H), indicating ease of exploitation and severe consequences; (2) Public exploit disclosure and KEV confirmation indicate active weaponization probability is high; (3) EPSS score likely elevated (typical 0.75+) given network accessibility, low attack complexity, and public POC availability; (4) Requires only low-privilege authenticated access (PR:L), not requiring admin credentials—many routers allow guest network or device management access; (5) CWE-119 class vulnerabilities in embedded firmware frequently lead to unauthenticated RCE chains when combined with authentication bypass flaws. Real-world impact: Complete router compromise, potential lateral network movement, data interception. This is a priority-1 vulnerability requiring immediate patching.

An attacker with access to the router's LAN (or who has gained valid user credentials through phishing/credential reuse) authenticates to the Tenda AC1206 web interface. The attacker crafts a malicious HTTP POST request to /goform/setMacFilterCfg with an oversized deviceList parameter containing shellcode. The stack overflow corrupts adjacent memory, allowing control of instruction pointer execution. The attacker achieves arbitrary code execution with the privileges of the web server process (typically root in embedded routers), enabling: (1) firmware modification, (2) persistent backdoor installation, (3) DNS/traffic redirection for MITM attacks, (4) network reconnaissance for lateral movement. Given public POC availability, attack complexity is low—automated exploitation tools likely exist. Attack initiation requires only valid authentication credentials and network connectivity to the router.