CVE-2025-15252
Published: 30 December 2025
Description
A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument startip/endip/leasetime/gateway/dns1/dns2 causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been…
more
published and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Validates manipulated parameters like startip, endip, leasetime, gateway, dns1, and dns2 to prevent stack-based buffer overflows in the formSetRemoteDhcpForAp function.
Implements memory protections such as stack canaries or address space layout randomization to mitigate stack-based buffer overflows exploitable remotely with low privileges.
Requires timely remediation of the identified buffer overflow flaw in Tenda M3 firmware version 1.0.0.13(4903) through patching to eliminate the vulnerability.
Security SummaryAI
CVE-2025-15252 is a stack-based buffer overflow vulnerability in the Tenda M3 router running firmware version 1.0.0.13(4903). The issue resides in the formSetRemoteDhcpForAp function within the /goform/setDhcpAP file, triggered by manipulating parameters such as startip, endip, leasetime, gateway, dns1, and dns2. This flaw, linked to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-12-30.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories and references, including a GitHub repository detailing the exploit at https://github.com/dwBruijn/CVEs/blob/main/Tenda/setRemoteDhcpForAp.md and VulDB entries at https://vuldb.com/?ctiid.338642, https://vuldb.com/?id.338642, and https://vuldb.com/?submit.725497, confirm the exploit has been publicly released and may be actively used. The manufacturer's site at https://www.tenda.com.cn/ provides general product information, but no specific patch details are outlined in the available references. Security practitioners should monitor for firmware updates and restrict access to the affected endpoint.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router's web interface (/goform/setDhcpAP) enables remote exploitation of a public-facing application (T1190) with low privileges, leading to arbitrary code execution consistent with exploitation for privilege escalation (T1068).