Ac6 Firmware EUVD-2025-17421

While the CVSS 3.1 score of 8.8 (High severity, Network-accessible, Low complexity, Low privileges required) indicates serious impact, the attack vector requires authenticated access (PR:L), which moderately reduces real-world exposure compared to unauthenticated vulnerabilities. However, multiple risk signals elevate actual priority: (1) Public exploit disclosure exists, enabling rapid weaponization; (2) The vulnerability affects a widely-deployed commodity router with limited update velocity in consumer environments; (3) Stack-based buffer overflows with code execution impact provide maximum confidentiality, integrity, and availability compromise (C:H/I:H/A:H); (4) The device's role as network perimeter equipment amplifies blast radius. EPSS exploitation probability would likely be moderate-to-high given PoC availability. KEV/CISA tracking status unknown from provided data but public disclosure warrants watchlist inclusion. The authentication requirement moderately mitigates against wormable propagation but does not eliminate risk in enterprise environments where router administrative access may be compromised or shared. Real-world priority is HIGH for organizations operating Tenda AC6 devices.

An attacker with valid administrative credentials (obtained through credential stuffing, phishing, or prior compromise) or valid user credentials on a network where the router is accessible sends a POST request to http://[router-ip]/goform/SetRebootTimer with a maliciously crafted rebootTime parameter containing a buffer overflow payload exceeding the fixed stack buffer size. The oversized input overwrites the function's return address on the stack with shellcode address or ROP gadget chain. Upon function return, control flow diverts to attacker's code executing with router process privileges (typically root), allowing complete system compromise: reading configuration files containing plaintext Wi-Fi credentials, modifying firewall rules, intercepting network traffic, or persisting backdoor access. In enterprise scenarios, a compromised router becomes a network pivot point for lateral movement. Public PoC availability means attack execution is trivial and requires only HTTP client knowledge, not sophisticated reverse-engineering capability.