Cyber Posture

CVE-2025-11356

HighPublic PoC

Published: 07 October 2025

Published
07 October 2025
Modified
09 October 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 51.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-11356 is a buffer overflow vulnerability affecting Tenda AC23 routers up to version 16.03.07.52. The issue resides in the sscanf function of the /goform/SetStaticRouteCfg file, where manipulation of the argument list triggers the overflow. Classified under CWE-119 and CWE-120, it was published on 2025-10-07 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges (PR:L) can exploit this remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution or denial of service. A public exploit is available and could be used.

Advisories from VulDB (e.g., https://vuldb.com/?id.327241) and a GitHub repository (https://github.com/cymiao1978/cve/blob/main/12.md) detail the vulnerability; the Tenda vendor site (https://www.tenda.com.cn/) may provide patches or further guidance.

The public availability of an exploit raises concerns for real-world exploitation against unpatched Tenda AC23 devices.

Details

CWE(s)
CWE-119CWE-120

Affected Products

tenda
ac23 firmware
16.03.07.52

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in the publicly accessible web interface (/goform/SetStaticRouteCfg) of Tenda AC23 router enables remote code execution or denial of service via exploitation of a public-facing application.

References