CVE-2025-11387: Tenda AC15 Buffer Overflow Vulnerability

CVE-2025-11387 Overview

CVE-2025-11387 is a stack-based buffer overflow [CWE-119] in the Tenda AC15 wireless router running firmware version 15.03.05.18. The flaw exists in an unspecified function within /goform/fast_setting_pppoe_set, where the Password parameter is copied into a fixed-size stack buffer without proper bounds checking. An attacker on the network can submit an oversized Password value to corrupt the stack and potentially execute arbitrary code on the device. The exploit details have been publicly disclosed on GitHub and VulDB, lowering the barrier for weaponization against exposed routers.

Critical Impact

Remote attackers with low privileges can trigger memory corruption against the router's web management interface, putting confidentiality, integrity, and availability of the device at risk.

Affected Products

• Tenda AC15 hardware router
• Tenda AC15 firmware version 15.03.05.18
• Deployments exposing the /goform/fast_setting_pppoe_set endpoint to untrusted networks

Discovery Timeline

• 2025-10-07 - CVE-2025-11387 published to NVD
• 2025-10-09 - Last updated in NVD database

Technical Details for CVE-2025-11387

Vulnerability Analysis

The Tenda AC15 web management interface handles PPPoE configuration through the /goform/fast_setting_pppoe_set handler. When a client submits credentials, the handler reads the Password form argument and copies it into a fixed-length stack buffer using an unsafe string operation. Because the routine does not validate the length of attacker-controlled input, an oversized Password value overruns the buffer and overwrites adjacent stack memory, including the saved return address.

The vulnerability is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Successful exploitation can crash httpd, disable the router, or yield arbitrary code execution in the context of the web server process, which typically runs with elevated privileges on embedded Linux router firmware.

Root Cause

The root cause is missing input length validation on the Password parameter inside the PPPoE quick-setup handler. The function trusts user-supplied data and uses an unbounded copy primitive such as strcpy or sprintf against a small stack-allocated destination. This is a recurring weakness in MIPS-based Tenda firmware exposed through /goform/* CGI endpoints.

Attack Vector

The attack is launched over the network against the router's HTTP management interface. An authenticated session is required, but Tenda devices frequently ship with weak or default credentials, and the management UI is often reachable from the LAN by any connected client. The attacker sends a crafted HTTP POST request to /goform/fast_setting_pppoe_set with a Password field containing a payload long enough to overflow the destination buffer and overwrite the return address with a controlled value.

For technical reproduction details, refer to the public proof-of-concept writeup in the GitHub IoT Vulnerability Documentation and the VulDB #327314 entry. No verified exploit code is reproduced here.

Detection Methods for CVE-2025-11387

Indicators of Compromise

• HTTP POST requests to /goform/fast_setting_pppoe_set containing abnormally long Password values, typically several hundred bytes or more.
• Unexpected restarts, crashes, or watchdog reboots of the httpd process on Tenda AC15 routers.
• New or unexplained outbound connections from the router after PPPoE configuration changes.
• Configuration drift in PPPoE settings without corresponding administrator activity.

Detection Strategies

• Inspect HTTP traffic to the router management interface and alert on requests to /goform/fast_setting_pppoe_set where the Password parameter exceeds expected length thresholds.
• Apply IDS/IPS signatures that match oversized form parameters or non-printable bytes inside PPPoE setup requests.
• Correlate router log events showing repeated httpd crashes or reboots with preceding HTTP POST activity.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized logging platform for retention and analysis.
• Monitor for management interface exposure on WAN-facing interfaces using external attack surface scanning.
• Baseline normal administrative traffic patterns so that anomalous /goform/* requests stand out for review.

How to Mitigate CVE-2025-11387

Immediate Actions Required

• Restrict access to the Tenda AC15 web management interface to trusted management VLANs only and disable remote WAN management.
• Change default and weak administrative credentials to long, unique passwords to raise the bar for the low-privilege precondition.
• Segment vulnerable routers away from sensitive internal assets until a vendor patch is available.
• Audit deployed Tenda devices and identify any units running firmware 15.03.05.18.

Patch Information

At the time of publication, no fixed firmware version has been published by the vendor for CVE-2025-11387. Monitor the Tenda Official Website for security advisories and firmware updates addressing the /goform/fast_setting_pppoe_set handler. Until a patch is released, organizations should treat affected devices as exposed and prioritize compensating controls.

Workarounds

• Disable the PPPoE quick-setup wizard if it is not required for the deployment.
• Place the router behind an upstream firewall that blocks untrusted hosts from reaching the management HTTP service.
• Replace end-of-support or unpatched AC15 units with a currently supported router model where feasible.
• Where possible, deploy network ACLs that restrict POST requests to /goform/fast_setting_pppoe_set to a small set of administrator workstations.