M3 CVE-2026-5567

Requires authenticated access to Tenda M3 router (version 1.0.0.10). Attacker must be logged in with credentials to access the /goform/setAdvPolicyData endpoint and manipulate the policyType parameter to trigger buffer overflow. Remote exploitation via web interface.

Real-world risk assessment requires balancing multiple signals. The CVSS 7.4 score reflects high potential impact (code execution with full device compromise) and low attack complexity, but the PR:L requirement creates a meaningful access barrier-attackers need valid credentials rather than anonymous access. Publicly available exploit code exists per GitHub reference, significantly lowering exploitation difficulty for threat actors who obtain credentials through phishing, default password reuse, or credential stuffing. However, no CISA KEV listing indicates this vulnerability is not confirmed actively exploited in widespread campaigns at time of analysis. EPSS data not provided, but typical router vulnerabilities with public POCs trend toward 5-15% exploitation probability within 30 days. The CVSS Environmental metric E:P (Proof-of-concept) confirms exploit maturity. SSVC framework considerations: exploitation status is POC (not active), automatable once authenticated (medium), technical impact is total device compromise (high). Primary risk factors are IoT/router context (often internet-exposed with weak credentials) and public POC availability. This represents moderate-to-high priority for organizations using affected Tenda M3 routers, particularly in small office/home office environments where credential hygiene may be weak.

An attacker conducts reconnaissance against a small business network and identifies a Tenda M3 router with default or weak administrative credentials exposed through port 80/443. After successfully authenticating to the web management interface using credentials obtained via brute-force or credential stuffing, the attacker crafts a malicious HTTP POST request to /goform/setAdvPolicyData with an oversized policyType parameter payload containing shellcode. The buffer overflow overwrites adjacent memory, hijacking execution flow to attacker-controlled code. The attacker achieves arbitrary code execution with router system privileges, enabling persistent backdoor installation, traffic interception via DNS hijacking, or lateral movement into the internal network by manipulating routing tables and firewall rules. Publicly available exploit code exists, reducing technical expertise required to weaponize this vulnerability against authenticated sessions.