CVE-2025-10803
Published: 22 September 2025
Summary
CVE-2025-10803 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac23 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow flaw in the sscanf function of the /goform/SetPptpServerCfg HTTP handler by applying vendor patches or updates.
Requires validation of the startIp argument in HTTP POST requests to the affected endpoint, preventing the buffer overflow triggered by malformed input.
Implements memory protections such as address space layout randomization and non-executable memory to block arbitrary code execution from the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (/goform/SetPptpServerCfg) via remote HTTP POST enables exploitation of public-facing application for initial access (T1190) and application/system exploitation for denial of service (T1499.004).
NVD Description
A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow.…
more
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-10803 is a buffer overflow vulnerability in Tenda AC23 routers up to version 16.03.07.52. The flaw affects the sscanf function within the /goform/SetPptpServerCfg component of the HTTP POST Request Handler, where manipulation of the startIp argument triggers the overflow. Published on 2025-09-22, it is classified under CWE-119 and CWE-120 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely by sending a crafted HTTP POST request to the affected endpoint. No user interaction is required, and exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or denial of service. The exploit has been publicly disclosed.
Advisories reference a GitHub repository containing details and a proof-of-concept for the Tenda AC23 buffer overflow, along with VulDB entries (ctiid.325161, id.325161, submit.654237) documenting the issue. Practitioners should consult the vendor site at tenda.com.cn for potential patches or mitigation steps.
Details
- CWE(s)