Cyber Posture

CVE-2025-11387

HighPublic PoC

Published: 07 October 2025

Published
07 October 2025
Modified
09 October 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0026 49.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-11387 is a stack-based buffer overflow vulnerability affecting the Tenda AC15 router on firmware version 15.03.05.18. The flaw exists in an unknown function of the /goform/fast_setting_pppoe_set file, where manipulation of the Password argument triggers the overflow. It is classified under CWE-119 and CWE-121, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A remote attacker with low privileges, such as an authenticated user, can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data, modification of system integrity, and denial of service, potentially leading to remote code execution via the buffer overflow.

Advisories note that the exploit has been publicly disclosed, with a proof-of-concept available at https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/fast_setting_pppoe_set.md. Additional details appear in VulDB entries at https://vuldb.com/?ctiid.327314, https://vuldb.com/?id.327314, and https://vuldb.com/?submit.664970. The vendor site is https://www.tenda.com.cn/, though no specific patch or mitigation guidance is detailed in the references.

Details

CWE(s)
CWE-119CWE-121

Affected Products

tenda
ac15 firmware
15.03.05.18

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in the router's web management interface (/goform/fast_setting_pppoe_set) via remote manipulation of the Password parameter enables remote code execution, facilitating exploitation of a public-facing application.

References