CVE-2025-10803: Tenda AC23 Buffer Overflow Vulnerability

CVE-2025-10803 Overview

CVE-2025-10803 is a buffer overflow vulnerability in the Tenda AC23 router firmware through version 16.03.07.52. The flaw resides in the sscanf function invoked by the /goform/SetPptpServerCfg endpoint within the HTTP POST request handler. An attacker who manipulates the startIp argument can overflow a fixed-size stack buffer, corrupting adjacent memory on the device.

The vulnerability is exploitable remotely over the network and requires only low-level privileges. Public disclosure includes technical details that lower the barrier for exploitation against exposed devices. The weakness is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers can trigger memory corruption on Tenda AC23 routers through crafted HTTP POST requests, potentially leading to arbitrary code execution on the device.

Affected Products

Tenda AC23 firmware versions up to and including 16.03.07.52
Tenda AC23 hardware revision 1.0
HTTP POST request handler component (/goform/SetPptpServerCfg)

Discovery Timeline

2025-09-22 - CVE-2025-10803 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10803

Vulnerability Analysis

The vulnerability exists in the PPTP server configuration handler exposed through the router's web management interface. When a client submits a POST request to /goform/SetPptpServerCfg, the handler parses the startIp parameter using the sscanf function. The parsing routine writes user-supplied data into a fixed-size stack buffer without validating the input length.

An attacker supplying an oversized startIp value corrupts the stack frame, overwriting saved registers and return addresses. This memory corruption can crash the httpd process or divert execution flow. Because the router runs services with elevated privileges, successful exploitation grants control over network traffic and device configuration.

Root Cause

The root cause is unsafe use of sscanf with unbounded format specifiers on attacker-controlled HTTP parameters. The Tenda firmware does not enforce a maximum length on the startIp string before copying it into the destination buffer. This pattern of trusting POST body content is common across Tenda AC-series firmware and has produced repeated buffer overflow disclosures.

Attack Vector

Exploitation requires network reachability to the router's HTTP management interface and authenticated access at the low-privilege level. An attacker sends a crafted POST request to the /goform/SetPptpServerCfg endpoint containing an oversized startIp value. The malformed request triggers stack corruption inside the httpd process handling the PPTP server configuration form.

Devices exposing the management interface to the WAN, or attackers pivoting from a compromised LAN client, can reach the vulnerable endpoint. Refer to the GitHub Buffer Overflow Report for the public technical write-up.

Detection Methods for CVE-2025-10803

Indicators of Compromise

HTTP POST requests to /goform/SetPptpServerCfg containing abnormally long startIp parameter values
Repeated httpd process crashes or restarts on the Tenda AC23 device
Unexpected changes to PPTP server configuration or router administrative settings
Outbound connections from the router to unfamiliar IP addresses following configuration changes

Detection Strategies

Inspect network traffic for POST requests to the /goform/SetPptpServerCfg URI and flag payloads where the startIp field exceeds typical IPv4 length
Deploy IDS signatures that match oversized parameter values sent to Tenda /goform/ endpoints
Correlate router log entries showing httpd service crashes with preceding HTTP requests from external sources

Monitoring Recommendations

Forward router syslog data to a centralized logging platform and alert on repeated web daemon restarts
Monitor the WAN-facing management interface for unauthorized access attempts and block administrative access from untrusted networks
Track firmware versions across deployed Tenda AC23 devices and alert when hosts remain on vulnerable builds

How to Mitigate CVE-2025-10803

Immediate Actions Required

Disable remote WAN management on Tenda AC23 devices to restrict access to the vulnerable /goform/SetPptpServerCfg endpoint
Disable the PPTP server feature if it is not required for operations
Restrict LAN-side access to the router's web interface through segmentation and strong administrative credentials
Rotate router administrator passwords, since exploitation requires low-privilege authenticated access

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2025-10803. Administrators should monitor the Tenda Official Website for firmware updates addressing this issue and apply them promptly upon release. Additional tracking information is available at VulDB #325161.

Workarounds

Place the router management interface behind a VPN or trusted management VLAN and block WAN-side HTTP access
Replace the affected device with a supported model if the vendor does not publish a fix within acceptable timelines
Apply upstream firewall rules that drop POST requests to /goform/SetPptpServerCfg from untrusted sources

bash

# Example: block external access to the Tenda web management interface
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP