Ax1803 Firmware CVE-2025-7597

This vulnerability presents HIGH real-world risk despite requiring authentication (PR:L in CVSS). Key risk factors: (1) CVSS 8.8 reflects the severe impact (full confidentiality/integrity/availability compromise) with low attack complexity and network accessibility; (2) Public exploit disclosure significantly increases exploitation probability; (3) The vulnerability is in a commonly deployed residential/SOHO router model with extensive installed base; (4) Stack-based buffer overflows are highly reliable for achieving RCE on embedded devices with weak ASLR/DEP protections typical in router firmware; (5) Authentication requirement is mitigated by weak default credentials common in Tenda devices and local network access scenarios. EPSS would likely be elevated given public POC availability. This is NOT a low-risk high-CVSS issue—it represents genuine, exploitable remote code execution in a network-critical device. Automatable exploitation is probable given the disclosed POC.

An attacker with valid credentials (or who has compromised default credentials) accesses the Tenda AX1803 web management interface at http://[router-ip]/goform/setMacFilterCfg. The attacker sends a crafted HTTP POST request with an oversized or specially-formatted deviceList parameter exceeding the stack buffer allocated for MAC filter entries. Due to lack of bounds checking, the overflow corrupts the stack, overwriting return addresses or other critical data structures. On embedded systems with minimal exploit mitigations (common in routers), this reliably achieves arbitrary code execution with router privileges. An attacker could install malware, intercept traffic, pivot to the local network, or establish persistent backdoor access. A public POC exists, meaning this can be automated and deployed at scale. In realistic scenarios, exploits might target routers with weak credentials exposed to local networks or devices accessible from the WAN if remote management was enabled by users.