Ac7 Firmware EUVD-2025-17427

CVSS 8.8 (High/Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant real-world risk. The attack requires network access and low privilege (L), but no user interaction (N), and impacts all three security properties (C:H/I:H/A:H). While the requirement for authentication (PR:L) raises the threshold versus unauthenticated attacks, exploitation remains practical given common weak default credentials in consumer routers or post-compromise lateral movement scenarios. The public disclosure of exploit code and presence of a proof-of-concept dramatically elevates exploitability likelihood. For embedded devices with limited/no patching mechanisms, this represents a persistent threat. SSVC would likely score this as 'Schedule/Out-of-Cycle' due to active exploitation evidence and high technical impact despite the authentication requirement. Priority should be HIGH for any organization managing Tenda AC7 devices.

An attacker with valid router credentials (obtained via default password, weak password, credential stuffing, or prior breach) logs into the router's web administration interface at http://192.168.0.1. They craft a request to /goform/AdvSetLanip with an oversized lanMask parameter (e.g., 512+ bytes instead of expected 15-byte IP mask format like '255.255.255.0'). The buffer overflow overwrites adjacent stack or heap structures, potentially the function return address. By carefully constructing the overflow payload with shellcode, the attacker achieves arbitrary code execution with root privileges on the router. From this position, they can: exfiltrate network traffic, modify DNS/DHCP configurations for MITM attacks, establish persistent backdoors, or use the device as a pivot point for further network compromise. Given public POC availability, this attack is automatable and could be weaponized in mass exploitation campaigns targeting unpatched Tenda AC7 deployments.