Ac15 Firmware EUVD-2026-16811

Requires authenticated access to Tenda AC15 router firmware version 15.03.05.19. Attacker must have valid credentials to POST requests to /goform/setcfm endpoint and craft malicious funcpara1 parameter to trigger stack-based buffer overflow. Remote exploitation without physical access.

The CVSS v4.0 score of 7.4 reflects high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) with a network-based attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L). The E:P modifier indicates proof-of-concept exploit code exists, which is confirmed by the public disclosure referenced in the intelligence data. However, no CISA KEV status is present, meaning confirmed active exploitation has not been documented. While the vulnerability requires authentication (PR:L), many Tenda routers ship with default credentials or weak passwords, potentially reducing this barrier in practice. The attack is fully remote and requires no user interaction (UI:N), making it highly automatable once credentials are obtained. The SSVC framework would classify this as a medium-to-high priority: exploitation is technically feasible with public POC code, the technical impact enables full system compromise of the router, and the attack is automatable. Real-world risk is elevated for environments where Tenda AC15 routers are deployed with default or weak credentials, particularly in SOHO and small business networks. Organizations should prioritize remediation given the combination of remote exploitability, public exploit availability, and the critical role routers play as network perimeter devices.

An external attacker who has obtained low-privilege credentials (through credential stuffing, default password exploitation, or password brute-forcing) authenticates to the Tenda AC15 router's web management interface over the network. The attacker crafts a malicious POST request to the /goform/setcfm endpoint, embedding an oversized payload in the funcpara1 parameter that exceeds the allocated stack buffer size. This crafted input overwrites the return address on the stack with an attacker-controlled value, redirecting program execution to injected shellcode. The attacker gains arbitrary code execution with the privileges of the web server process, typically running as root or with administrative access on embedded router systems. From this position, the attacker can modify router configuration, establish persistent backdoors, intercept or redirect network traffic, pivot to internal network resources, or brick the device. Given that publicly available exploit code exists, even moderately skilled attackers can leverage existing tools to compromise vulnerable devices at scale.