CVE-2025-15232 in Tenda
Summary
by MITRE • 12/30/2025
A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The manipulation of the argument mac/terminal leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/30/2025
This vulnerability exists within the Tenda M3 router firmware version 1.0.0.13(4903) and specifically targets the formSetAdPushInfo function located in the /goform/setAdPushInfo file. The flaw represents a stack-based buffer overflow condition that occurs when processing the mac/terminal argument parameter. This type of vulnerability falls under the CWE-121 category of stack-based buffer overflow, where insufficient bounds checking allows an attacker to overwrite adjacent memory locations on the program stack. The vulnerability is particularly concerning because it can be exploited remotely without requiring physical access to the device, making it accessible to attackers anywhere on the network. The attack vector is classified as remote exploitation since the vulnerable function is exposed through a web interface that accepts HTTP requests containing malicious input parameters.
The operational impact of this vulnerability extends beyond simple remote code execution capabilities, as it can potentially allow attackers to gain unauthorized access to the router's administrative functions and manipulate network configurations. The stack-based nature of the overflow means that attackers can overwrite return addresses, function pointers, and other critical stack data structures to redirect program execution flow. This vulnerability directly maps to ATT&CK technique T1210 - Exploitation of Remote Services, where adversaries leverage vulnerabilities in network services to execute malicious code. Given that the exploit is publicly available and actively used in the wild, the risk assessment for this vulnerability is elevated significantly, as it reduces the barrier to exploitation from advanced persistent threats to readily available attack toolkits. The affected router model represents a common consumer-grade device that many users may not update regularly, increasing the potential attack surface.
Mitigation strategies for this vulnerability should begin with immediate firmware updates from Tenda to address the specific buffer overflow condition in the setAdPushInfo function. Network segmentation and firewall rules should be implemented to restrict access to the router's administrative web interface from untrusted networks, limiting the attack surface for remote exploitation attempts. Access control measures including strong authentication mechanisms and regular credential rotation should be enforced to prevent unauthorized access even if the device is compromised. Network monitoring solutions should be deployed to detect anomalous traffic patterns that might indicate exploitation attempts, particularly focusing on unusual HTTP requests targeting the vulnerable /goform/setAdPushInfo endpoint. Security professionals should also consider implementing intrusion detection systems that can identify known exploit signatures for this specific vulnerability. The vulnerability's classification as a stack-based buffer overflow also necessitates runtime protections such as stack canaries, address space layout randomization, and non-executable stack segments to prevent successful exploitation even if the vulnerability remains unpatched. Organizations should conduct comprehensive network assessments to identify all affected Tenda M3 devices and prioritize remediation efforts based on the devices' criticality within their network infrastructure.