CVE-2025-15217
Published: 30 December 2025
Description
A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring risk-based prioritization and remediation of the buffer overflow flaw in the formSetPPTPUserList function via patches or firmware updates.
Validates the argument list in HTTP POST requests to the handler, preventing manipulation that triggers the buffer overflow.
Implements runtime memory protections such as stack guards or non-executable memory to block unauthorized code execution from the buffer overflow.
Security SummaryAI
CVE-2025-15217 is a buffer overflow vulnerability affecting the Tenda AC23 router running firmware version 16.03.07.52. The flaw resides in the formSetPPTPUserList function of the HTTP POST Request Handler component, where manipulation of the argument list triggers the overflow. Published on 2025-12-30, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
A remote attacker with low privileges can exploit this vulnerability by sending a specially crafted HTTP POST request over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact outcomes, including unauthorized disclosure of confidential information, modification of system data or behavior, and disruption of availability, potentially leading to full remote code execution or device compromise.
Advisories and additional details are documented in references from VulDB (including ctiid.338602, id.338602, and submit.725448) and a dedicated analysis on Notion, with the vendor site at tenda.com.cn. Security practitioners should review these sources for any available patches, workarounds, or firmware updates to mitigate the issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in HTTP POST handler of router's web interface enables remote exploitation from low privileges to RCE, directly facilitating Exploit Public-Facing Application (T1190) and Exploitation for Privilege Escalation (T1068).