Ac18 Firmware EUVD-2025-16917

This vulnerability presents substantial real-world risk across multiple dimensions: (1) CVSS 8.8 indicates high severity with network-accessible attack vector (AV:N), low attack complexity (AC:L), but requiring low privileges (PR:L), meaning the attacker needs valid router credentials; (2) The presence of a public proof-of-concept significantly elevates exploitation likelihood; (3) Buffer overflow vulnerabilities are inherently automatable and lead to complete system compromise (C:H/I:H/A:H) including RCE; (4) The authentication requirement (PR:L) moderately reduces attack surface compared to unauthenticated RCE, but router credentials are frequently weak, unchanged defaults, or leaked; (5) Router firmware vulnerabilities are particularly critical as they provide persistent access and can affect all traffic on the network. The SSVC analysis would score this as CRITICAL given public POC, remote exploitability, and complete control impact despite authentication requirement. This is NOT a high-CVSS-but-low-risk issue—it represents genuine critical threat to router security.

An attacker with access to the router's web management interface (either through default credentials, credential compromise, or same-network access) navigates to or directly requests the /goform/setPptpUserList endpoint. The attacker crafts an HTTP POST request with a maliciously oversized 'list' parameter containing a carefully constructed buffer overflow payload. This payload overwrites adjacent memory including the return address or function pointers. When the vulnerable formSetPPTPUserList function processes the input without bounds checking, the overflow executes the attacker's shellcode, achieving remote code execution with root-level privileges on the router. The attacker can then: establish persistent backdoor access, intercept/modify network traffic, launch further attacks on connected devices, or use the compromised router as a pivot point into the network. Public POC availability means this attack requires no advanced exploitation skills. Attack complexity is low (AC:L) as the exploit does not require special conditions, timing, or user interaction beyond crafting the malicious request.