Ac18 Firmware EUVD-2025-16922

This vulnerability presents substantial real-world risk despite being a known vulnerability class. CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates: (1) Network-accessible attack requiring no special conditions, (2) Low attack complexity with straightforward exploitation, (3) Authentication required but only standard user credentials, (4) Immediate impact across all security triples (confidentiality, integrity, availability). The existence of public exploit code and low AC:L rating substantially elevates real-world risk. However, the PR:L (Privilege:Low) requirement slightly reduces the attack surface compared to unauthenticated exploits. SSVC perspective: exploitation status is ACTIVE (POC public), automatable=YES (network-based buffer overflow), technical impact=TOTAL (code execution). This should be prioritized for immediate patching, particularly in internet-exposed deployments. The combination of authenticated-but-simple exploitation, public POC availability, and critical impact makes this a high-priority vulnerability despite the authentication requirement.

An attacker with valid router credentials (obtained through credential reuse, phishing, or default credentials) crafts an HTTP POST request to http://[router-ip]/goform/SetSysAutoRebbotCfg with a maliciously oversized rebootTime parameter (e.g., 10,000+ characters instead of expected format). The vulnerable formsetreboottimer function copies this unsanitized input into a fixed-size stack buffer without bounds checking. The attacker's payload includes: (1) padding to reach the return address, (2) shellcode for command execution, and (3) return address pointing to the injected shellcode. Upon function return, execution redirects to the attacker's code, granting remote code execution with router privileges. The attacker can then establish persistent backdoor access, intercept network traffic, modify DNS settings, or pivot to other network devices. Public POC code exists, making this trivial to exploit for any moderately skilled attacker with network access and valid credentials.