CVE-2025-5848 Overview
CVE-2025-5848 is a buffer overflow vulnerability in the Tenda AC15 wireless router running firmware version 15.03.05.19_multi. The flaw resides in the formSetPPTPUserList function within the /goform/setPptpUserList endpoint of the HTTP POST request handler. Attackers can manipulate the list argument to trigger memory corruption [CWE-119]. The vulnerability is exploitable remotely over the network and the exploit details have been publicly disclosed.
Critical Impact
Remote attackers with low privileges can trigger a buffer overflow in the Tenda AC15 web management interface, leading to potential denial of service or arbitrary code execution on the device.
Affected Products
- Tenda AC15 router (hardware version 1.0)
- Tenda AC15 firmware version 15.03.05.19_multi
- HTTP POST request handler component /goform/setPptpUserList
Discovery Timeline
- 2025-06-08 - CVE-2025-5848 published to NVD
- 2025-06-09 - Last updated in NVD database
Technical Details for CVE-2025-5848
Vulnerability Analysis
The vulnerability exists in the formSetPPTPUserList function, which processes HTTP POST requests to the /goform/setPptpUserList endpoint. This endpoint configures Point-to-Point Tunneling Protocol (PPTP) user list entries on the router. The function fails to validate the length of the list parameter before copying it into a fixed-size stack buffer, producing a classic buffer overflow condition [CWE-119].
Because Tenda AC15 firmware images are typically built without modern exploit mitigations such as stack canaries, full address space layout randomization, or non-executable stack enforcement on all memory regions, a controlled overflow can corrupt the saved return address. Successful exploitation allows attackers to redirect execution flow on the MIPS-based device.
The attack vector is network-based with low attack complexity. The attacker requires low privileges, consistent with access to the router's web management interface. The vulnerability impacts confidentiality, integrity, and availability of the affected device. The EPSS probability is 0.621% with a percentile of 70.4.
Root Cause
The root cause is improper restriction of operations within the bounds of a memory buffer. The formSetPPTPUserList handler accepts the list argument from an untrusted HTTP POST body and performs an unbounded copy into a stack-allocated buffer. The handler does not enforce a maximum length check before the copy operation.
Attack Vector
An authenticated attacker on the network sends a crafted HTTP POST request to /goform/setPptpUserList with an oversized list parameter. The oversized payload overflows the destination buffer, overwriting adjacent stack memory including the saved return address. The malformed request can be delivered over LAN, or over WAN if the management interface is exposed.
No verified proof-of-concept code is included here. Technical write-ups are available on the Notion page describing the Tenda AC15 formSetPPTPUserList issue and the VulDB entry #311594.
Detection Methods for CVE-2025-5848
Indicators of Compromise
- HTTP POST requests to /goform/setPptpUserList containing abnormally long list parameter values
- Unexpected reboots, httpd crashes, or watchdog resets on Tenda AC15 devices following inbound HTTP traffic
- New or unauthorized PPTP user entries appearing in the router configuration
- Outbound connections from the router to unknown infrastructure following web management traffic
Detection Strategies
- Inspect HTTP POST bodies destined for /goform/setPptpUserList and alert on list parameter values exceeding expected length thresholds
- Deploy network intrusion detection signatures targeting oversized payloads to Tenda goform endpoints
- Correlate router syslog crash events with preceding inbound HTTP requests to the management interface
Monitoring Recommendations
- Forward router syslog, authentication, and configuration-change events to a centralized logging platform for retention and correlation
- Monitor for changes to PPTP user lists and other VPN settings outside of approved change windows
- Track WAN-side access attempts to the router's HTTP administration port
How to Mitigate CVE-2025-5848
Immediate Actions Required
- Disable remote WAN management on Tenda AC15 devices and restrict access to the web interface to trusted LAN segments
- Change default and weak administrative credentials to reduce the chance of an attacker obtaining the low privileges required for exploitation
- Segment vulnerable consumer-grade routers away from sensitive internal assets
- Consider replacing end-of-support Tenda AC15 hardware with a vendor-supported alternative if no fixed firmware is released
Patch Information
At the time of publication, no vendor advisory or patched firmware release has been associated with CVE-2025-5848. Check the Tenda official website for firmware updates addressing the formSetPPTPUserList issue. Until an official fix is provided, apply the workarounds below.
Workarounds
- Block external access to TCP ports 80 and 443 on the router's WAN interface using an upstream firewall
- Restrict access to the /goform/setPptpUserList endpoint by limiting management plane traffic to a dedicated administrative VLAN
- Disable PPTP server functionality on the router if it is not required for business operations
- Apply ACLs on upstream network equipment to drop oversized HTTP POST requests targeting the router's management interface
# Example upstream firewall rule to block WAN-side access to the router management interface
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
