840g Firmware EUVD-2025-21306

Risk signals present a coherent high-priority picture: (1) CVSS 8.8 reflects network-accessible attack vector (AV:N), low complexity (AC:L), but requires low privilege (PR:L) authentication—not unauthenticated, which moderates risk slightly; (2) All impact metrics (Confidentiality, Integrity, Availability) are HIGH, enabling complete system compromise; (3) Public exploit disclosure + vendor non-responsiveness = near-certain active exploitation; (4) KEV status likely KNOWN_EXPLOITED given public POC and vendor silence; (5) EPSS score would be elevated (likely >70%) due to public exploit, network accessibility, and authentication requirement being common in enterprise environments; (6) SSVC framework: exploitation=ACTIVE, automatable=YES (network buffer overflow), technical_impact=TOTAL → PATCH_NOW priority. This is NOT a low-real-risk-high-CVSS issue; the combination of public POC, vendor non-response, authenticated-but-common attack vector, and complete compromise potential makes it a legitimate critical priority.

An authenticated attacker (internal network user, compromised legitimate account, or attacker who obtained weak credentials via phishing) sends a crafted HTTP POST/GET request to /goform/aspRemoteApConfTempSend with an oversized remoteSrcTemp parameter containing shellcode and ROP gadgets. The web server copies the parameter into a fixed stack buffer without bounds checking, overwriting the return address. Upon function return, execution jumps to attacker-controlled code, granting shell access with device privileges (likely root). From this position, the attacker can pivot to other network segments, exfiltrate traffic, modify firewall rules, or launch supply-chain attacks on downstream systems. Public POC tools enable script-kiddie-level exploitation; no manual reverse-engineering required. Attack complexity is LOW—exploitation is deterministic.