Ac7 Firmware EUVD-2025-17426

This vulnerability presents CRITICAL real-world risk despite the authentication requirement (PR:L). Risk signals analysis: (1) CVSS 8.8 reflects high severity with high impact (C:H, I:H, A:H) and low attack complexity (AC:L), indicating straightforward exploitation; (2) Authentication requirement (PR:L) reduces attack surface to authenticated users or lateral movement scenarios within compromised networks; (3) Network accessibility (AV:N) enables remote exploitation from any network position; (4) Public POC availability significantly increases exploitation probability and lowers attacker skill requirements; (5) Embedded router context means vulnerable devices have extended deployment lifespans with slow patching cycles; (6) No scope change (S:U) indicates impact limited to the affected router but complete compromise of that device is achievable. EPSS exploitation probability is likely elevated (estimated >0.50) given POC availability. This is NOT a low-real-risk issue—the authentication gate is insufficient mitigation for devices with default/weak credentials or those where initial compromise has already occurred. Router firmware vulnerabilities are particularly dangerous as they can enable network-wide attacks.

An attacker with network access (remote) authenticates to the Tenda AC7 web interface using either default credentials (admin/admin) common on unconfigured devices, credentials obtained through phishing, or credentials from a previously compromised network segment. The attacker then sends a crafted POST request to /goform/setPptpUserList with an oversized 'list' parameter containing shellcode (typically ~200-300 bytes of buffer overflow before reaching the return address). The buffer overflow overwrites the return pointer on the stack, redirecting execution to attacker-controlled code in the shellcode payload. This results in arbitrary code execution with root privileges on the router, enabling installation of persistent backdoors, network traffic interception, DNS poisoning, or lateral movement attacks against other network devices. Public POC likely automates credential guessing, crafting the overflow payload, and establishing a reverse shell. Typical exploitation time: <5 minutes for an attacker with functional POC code.