CVE-2025-15231
Published: 30 December 2025
Description
A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipulation of the argument ID/vlan/port can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been…
more
publicly disclosed and may be utilized.
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the stack-based buffer overflow by applying vendor firmware patches to fix the vulnerable formSetRemoteVlanInfo function.
Information input validation enforces bounds checking on ID, vlan, and port arguments to prevent the buffer overflow manipulation.
Memory protection mechanisms such as stack canaries and non-executable stacks mitigate exploitation of the buffer overflow for arbitrary code execution.
Security SummaryAI
CVE-2025-15231 is a stack-based buffer overflow vulnerability affecting the Tenda M3 router on firmware version 1.0.0.13(4903). The flaw exists in the formSetRemoteVlanInfo function within the /goform/setVlanInfo file, where manipulation of the ID, vlan, or port arguments triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network with low complexity and no user interaction, but requires low privileges such as basic authentication. An attacker could achieve high impacts across confidentiality, integrity, and availability, potentially leading to arbitrary code execution on the affected device through the buffer overflow.
Advisories and further details are documented on VulDB (ctiid.338627, id.338627, submit.725493), with a public exploit disclosure available on GitHub at dwBruijn/CVEs/blob/main/Tenda/setRemoteVlanInfo.md. The Tenda manufacturer website (tenda.com.cn) provides general product information, though specific patch guidance is not detailed in the referenced sources.
The exploit has been publicly disclosed and may be utilized, increasing the risk of real-world attacks against unpatched Tenda M3 devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in web form (/goform/setVlanInfo) on public-facing Tenda M3 router enables remote code execution with low privileges, directly facilitating T1190: Exploit Public-Facing Application.