CVE-2025-11121
Published: 28 September 2025
Summary
CVE-2025-11121 is a low-severity Injection (CWE-74) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A security vulnerability identified as CVE-2025-11121 affects the Tenda AC18 router running firmware version 15.03.05.19. The flaw resides in an unspecified function within the /goform/AdvSetLanip endpoint, where improper handling of the lanIp argument permits command injection. The issue is tracked under CWE-74 and CWE-77 and carries a low CVSS 4.0 base score of 2.1, reflecting the need for an authenticated remote attacker.
An authenticated remote attacker can supply a crafted lanIp value to the endpoint and execute arbitrary commands on the device. Public exploit code has been released, enabling potential use by anyone with valid credentials to the router's management interface. The attack requires no user interaction beyond network reachability and valid login privileges.
The EPSS score remains flat at 0.0111 with no observed increase after disclosure. Available references consist of a public proof-of-concept and vulnerability database entries but contain no vendor advisory or patch information from Tenda.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31478
Vulnerability details
A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initiated remotely. The exploit has…
more
been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated remote command injection vulnerability in the /goform/AdvSetLanip web endpoint of the Tenda AC18 router enables exploitation of a public-facing application (T1190), abuse of command and scripting interpreters via injected OS commands (T1059), and indirect command execution (T1202, as mapped by VulDB).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the lanIp input parameter to block command injection into /goform/AdvSetLanip.
Mandates timely patching or firmware updates to eliminate the command-injection flaw in AdvSetLanip before exploitation.
Restricts authenticated users to the minimum privileges needed, limiting the impact of any successful lanIp injection.