CVE-2025-15230
Published: 30 December 2025
Description
A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performing a manipulation of the argument qvlan_truck_port results in heap-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit has been made public and could be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly validates inputs like the qvlan_truck_port argument to prevent heap buffer overflows from improper data manipulation in the formSetVlanPolicy function.
Implements memory safeguards such as address space layout randomization and non-executable heaps to mitigate exploitation of heap-based buffer overflows even if invalid input is processed.
Ensures timely remediation of the specific heap buffer overflow flaw in Tenda M3 firmware version 1.0.0.13(4903) through patching or updates.
Security SummaryAI
CVE-2025-15230 is a heap-based buffer overflow vulnerability affecting the Tenda M3 router on firmware version 1.0.0.13(4903). The flaw resides in the formSetVlanPolicy function within the /goform/setVlanPolicyData file, where manipulation of the qvlan_truck_port argument triggers the overflow. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow).
Remote exploitation is possible over the network with low complexity and no user interaction. Per the CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), attackers require only low privileges, such as those of an authenticated user, to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution.
Advisories from VulDB (ctiid.338626, id.338626, submit.725490) document the issue, while a public exploit proof-of-concept is available on GitHub at dwBruijn/CVEs/blob/main/Tenda/setVlanPolicy.md. The Tenda vendor site at tenda.com.cn provides relevant product information for checking firmware updates or patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-based buffer overflow in public-facing router web interface (/goform/setVlanPolicyData) enables remote exploitation for arbitrary code execution with low privileges (PR:L), directly mapping to T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation).