CVE-2025-11387
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Tenda AC15 routers via the /goform/fast_setting_pppoe_set endpoint when manipulating the Password argument. This allows remote attackers to potentially execute arbitrary code or crash the device. Users of Tenda AC15 routers with the vulnerable firmware are affected.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement into connected networks.
Likely Case
Device crash causing denial of service, potentially requiring physical reset or firmware reflash.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code available on GitHub, requires network access to web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to web management interface
Network Segmentation
allIsolate router on separate VLAN with restricted access
🧯 If You Can't Patch
- Replace affected device with supported model
- Implement strict firewall rules blocking all access to router web interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or similar sectionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 15.03.05.18📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/fast_setting_pppoe_set with long Password parameter
- Router crash/reboot logs
Network Indicators:
- Unusual HTTP traffic to router management port with buffer overflow patterns
SIEM Query:
source="router_logs" AND (uri="/goform/fast_setting_pppoe_set" OR message="buffer overflow")