Ac5 Firmware EUVD-2025-17437

The CVSS 3.1 score of 8.8 (High) accurately reflects genuine risk: Attack Vector is Network (AV:N, remotely exploitable), Attack Complexity is Low (AC:L, no special conditions required), and Privileges Required is Low (PR:L, requires authentication but often trivial on consumer routers with default credentials). The vector yields High impact across all three CIA triad dimensions (C:H/I:H/A:H), enabling remote code execution. Critical risk factors converge: (1) Public POC availability dramatically increases exploitation probability; (2) The vulnerability is in an unauthenticated-accessible endpoint on a consumer device where default credentials are common knowledge; (3) No KEV status explicitly stated, but public disclosure + POC availability = near-certain active exploitation attempts; (4) This is NOT a high-CVSS-but-low-risk issue—it is a genuine critical priority because Tenda AC5 routers are widely deployed in SOHO environments, firmware updates are infrequent, and compromised routers enable lateral network attacks. SSVC framework: Exploitation=Demonstrated/Active, Automatable=Yes (buffer overflow exploits are readily weaponized), Technical Impact=Total. Decision: IMMEDIATE action required.

An attacker on the same network (or with routing access to the router's management interface) authenticates to the router using default credentials (e.g., admin/admin). The attacker crafts an HTTP POST request to /goform/SetRebootTimer with a maliciously oversized 'rebootTime' parameter (e.g., 10,000+ bytes instead of expected 4-10 bytes). The formSetRebootTimer function reads this parameter into a fixed stack buffer without bounds checking, causing a stack overflow. The attacker constructs the payload to overwrite the return address on the stack, redirecting execution to attacker-controlled shellcode or a ROP chain. Upon function return, the router executes arbitrary code with root privileges, enabling: (1) persistent backdoor installation, (2) credential harvesting from LAN clients, (3) DNS hijacking/MITM attacks, (4) botnet recruitment, or (5) lateral movement into corporate networks if the router is on a business LAN. Public POC code likely exists in exploit repositories (e.g., GitHub, Exploit-DB), requiring minimal modification for weaponization. Attack complexity is Low because no special environment configuration is required—any Tenda AC5 running firmware 15.03.06.47 is vulnerable with default or weak credentials.