Ac18 Firmware EUVD-2025-16919

This vulnerability presents HIGH real-world risk despite authentication requirements due to multiple convergent factors: (1) CVSS 8.8 reflects accurate severity—authenticated remote code execution with complete system impact (C:H, I:H, A:H); (2) Public POC availability dramatically increases exploitation probability and EPSS score; (3) AC:L (Low Complexity) means no special conditions required once authenticated; (4) The attack surface is a standard router web interface, ubiquitously exposed to trusted networks; (5) Authentication requirement (PR:L) is a single control point—many users share router admin credentials or authentication can be bypassed via default credentials; (6) Tenda routers are budget consumer-grade devices with typically poor patch management. CVSS vector AV:N/AC:L/PR:L/UI:N/S:U indicates this is genuinely exploitable, not theoretical. Given public POC and disclosure, this should be escalated to immediate patch-or-replace priority for any organization with Tenda AC18 devices.

An authenticated attacker (e.g., compromised user with admin credentials, or attacker on the same network with default credentials) sends a crafted HTTP POST request to /goform/AdvSetLanip with an oversized lanMask parameter. The CGI handler's fromadvsetlanip function copies this input without bounds checking, overflowing a stack buffer. The attacker crafts the payload with shellcode, overwriting the return address to redirect execution. Result: arbitrary code execution with router privileges (root), enabling attacker to: capture traffic, redirect DNS, establish reverse shells, use router as botnet node, or pivot to internal network. The low complexity (AC:L) and no user interaction (UI:N) mean this can be automated; combined with public POC, mass exploitation of poorly-patched Tenda AC18 devices in corporate/SMB environments is realistic.