EUVD-2025-17418
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical remote buffer overflow vulnerability in Tenda AC6 firmware version 15.03.05.16 affecting the LAN IP configuration endpoint. An authenticated remote attacker can exploit improper input validation in the lanMask parameter of the /goform/AdvSetLanip function to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code has been disclosed, making this an active threat with elevated real-world risk despite the authentication requirement.
Technical Context
The vulnerability exists in the Tenda AC6 wireless router's web management interface, specifically in the AdvSetLanip form handler function. The lanMask parameter, intended to receive a dotted-decimal subnet mask (e.g., 255.255.255.0), lacks proper bounds checking before being written to a fixed-size stack buffer. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) stack-based buffer overflow. The affected CPE is cpe:2.3:o:tenda:ac6_firmware:15.03.05.16:*:*:*:*:*:*:*. The /goform/AdvSetLanip endpoint is part of Tenda's HTTP-based router administration API, exposed on the default management interface (typically port 80/443). The use of strcpy() or similar unsafe string functions without length validation in C-based firmware is the likely root cause.
Affected Products
Tenda AC6 (['15.03.05.16'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today