CVE-2025-15230
Published: 30 December 2025
Summary
CVE-2025-15230 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda M3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates inputs like the qvlan_truck_port argument to prevent heap buffer overflows from improper data manipulation in the formSetVlanPolicy function.
Implements memory safeguards such as address space layout randomization and non-executable heaps to mitigate exploitation of heap-based buffer overflows even if invalid input is processed.
Ensures timely remediation of the specific heap buffer overflow flaw in Tenda M3 firmware version 1.0.0.13(4903) through patching or updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-based buffer overflow in public-facing router web interface (/goform/setVlanPolicyData) enables remote exploitation for arbitrary code execution with low privileges (PR:L), directly mapping to T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation).
NVD Description
A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performing a manipulation of the argument qvlan_truck_port results in heap-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit has been made public and could be used.
Deeper analysisAI
CVE-2025-15230 is a heap-based buffer overflow vulnerability affecting the Tenda M3 router on firmware version 1.0.0.13(4903). The flaw resides in the formSetVlanPolicy function within the /goform/setVlanPolicyData file, where manipulation of the qvlan_truck_port argument triggers the overflow. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow).
Remote exploitation is possible over the network with low complexity and no user interaction. Per the CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), attackers require only low privileges, such as those of an authenticated user, to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution.
Advisories from VulDB (ctiid.338626, id.338626, submit.725490) document the issue, while a public exploit proof-of-concept is available on GitHub at dwBruijn/CVEs/blob/main/Tenda/setVlanPolicy.md. The Tenda vendor site at tenda.com.cn provides relevant product information for checking firmware updates or patches.
Details
- CWE(s)