Cyber Posture

CVE-2025-15217

HighPublic PoC

Published: 30 December 2025

Published
30 December 2025
Modified
24 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 34.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring risk-based prioritization and remediation of the buffer overflow flaw in the formSetPPTPUserList function via patches or firmware updates.

prevent

Validates the argument list in HTTP POST requests to the handler, preventing manipulation that triggers the buffer overflow.

prevent

Implements runtime memory protections such as stack guards or non-executable memory to block unauthorized code execution from the buffer overflow.

Security SummaryAI

CVE-2025-15217 is a buffer overflow vulnerability affecting the Tenda AC23 router running firmware version 16.03.07.52. The flaw resides in the formSetPPTPUserList function of the HTTP POST Request Handler component, where manipulation of the argument list triggers the overflow. Published on 2025-12-30, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).

A remote attacker with low privileges can exploit this vulnerability by sending a specially crafted HTTP POST request over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact outcomes, including unauthorized disclosure of confidential information, modification of system data or behavior, and disruption of availability, potentially leading to full remote code execution or device compromise.

Advisories and additional details are documented in references from VulDB (including ctiid.338602, id.338602, and submit.725448) and a dedicated analysis on Notion, with the vendor site at tenda.com.cn. Security practitioners should review these sources for any available patches, workarounds, or firmware updates to mitigate the issue.

Details

CWE(s)

Affected Products

tenda
ac23 firmware
16.03.07.52

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Buffer overflow in HTTP POST handler of router's web interface enables remote exploitation from low privileges to RCE, directly facilitating Exploit Public-Facing Application (T1190) and Exploitation for Privilege Escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References