Ac6 Firmware EUVD-2025-17416

CVSS 3.1 score of 8.8 (High) with network-accessible attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L) indicates substantial real-world risk. The authentication requirement (PR:L) moderates immediate exposure in typical scenarios, but compromised user credentials or CSRF chaining reduces this barrier significantly. CWE-119 buffer overflows are historically high-impact and frequently automatable once an exploit primitive is developed. Public disclosure of exploit code and confirmed proof-of-concept availability elevate EPSS exploitation probability to critical levels. This is NOT a false-positive high-CVSS score; buffer overflows with remote network access and public exploits represent genuine critical infrastructure risk, particularly in IoT/network device scenarios where routers may be internet-exposed or subjected to insider threats. The authentication gate (PR:L) prevents mass worm-like propagation but does not reduce priority given router compromise implications.

An authenticated attacker with valid router credentials (obtained via phishing, credential reuse, or default credentials) or an unauthenticated attacker who has chained a CSRF vulnerability crafts an HTTP POST request to http://[router-ip]/goform/setPptpUserList with a maliciously crafted 'list' parameter containing a buffer overflow payload. The payload overwrites stack memory containing function return addresses, redirecting execution to injected shellcode. This grants the attacker remote code execution as the root-privileged web service process, enabling full router compromise: credential theft, traffic interception, botnet infection, or use as a pivot point for lateral network attacks. Public POC availability means this attack is trivial to reproduce. The attack requires no user interaction (UI:N) and low complexity (AC:L), making it suitable for automated exploitation against exposed or internally-compromised routers.