CVE-2025-15217
Published: 30 December 2025
Summary
CVE-2025-15217 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Ac23 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring risk-based prioritization and remediation of the buffer overflow flaw in the formSetPPTPUserList function via patches or firmware updates.
Validates the argument list in HTTP POST requests to the handler, preventing manipulation that triggers the buffer overflow.
Implements runtime memory protections such as stack guards or non-executable memory to block unauthorized code execution from the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in HTTP POST handler of router's web interface enables remote exploitation from low privileges to RCE, directly facilitating Exploit Public-Facing Application (T1190) and Exploitation for Privilege Escalation (T1068).
NVD Description
A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely.
Deeper analysisAI
CVE-2025-15217 is a buffer overflow vulnerability affecting the Tenda AC23 router running firmware version 16.03.07.52. The flaw resides in the formSetPPTPUserList function of the HTTP POST Request Handler component, where manipulation of the argument list triggers the overflow. Published on 2025-12-30, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
A remote attacker with low privileges can exploit this vulnerability by sending a specially crafted HTTP POST request over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact outcomes, including unauthorized disclosure of confidential information, modification of system data or behavior, and disruption of availability, potentially leading to full remote code execution or device compromise.
Advisories and additional details are documented in references from VulDB (including ctiid.338602, id.338602, and submit.725448) and a dedicated analysis on Notion, with the vendor site at tenda.com.cn. Security practitioners should review these sources for any available patches, workarounds, or firmware updates to mitigate the issue.
Details
- CWE(s)