CVE-2025-15252
Published: 30 December 2025
Summary
CVE-2025-15252 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda M3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates manipulated parameters like startip, endip, leasetime, gateway, dns1, and dns2 to prevent stack-based buffer overflows in the formSetRemoteDhcpForAp function.
Implements memory protections such as stack canaries or address space layout randomization to mitigate stack-based buffer overflows exploitable remotely with low privileges.
Requires timely remediation of the identified buffer overflow flaw in Tenda M3 firmware version 1.0.0.13(4903) through patching to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router's web interface (/goform/setDhcpAP) enables remote exploitation of a public-facing application (T1190) with low privileges, leading to arbitrary code execution consistent with exploitation for privilege escalation (T1068).
NVD Description
A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument startip/endip/leasetime/gateway/dns1/dns2 causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been…
more
published and may be used.
Deeper analysisAI
CVE-2025-15252 is a stack-based buffer overflow vulnerability in the Tenda M3 router running firmware version 1.0.0.13(4903). The issue resides in the formSetRemoteDhcpForAp function within the /goform/setDhcpAP file, triggered by manipulating parameters such as startip, endip, leasetime, gateway, dns1, and dns2. This flaw, linked to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-12-30.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories and references, including a GitHub repository detailing the exploit at https://github.com/dwBruijn/CVEs/blob/main/Tenda/setRemoteDhcpForAp.md and VulDB entries at https://vuldb.com/?ctiid.338642, https://vuldb.com/?id.338642, and https://vuldb.com/?submit.725497, confirm the exploit has been publicly released and may be actively used. The manufacturer's site at https://www.tenda.com.cn/ provides general product information, but no specific patch details are outlined in the available references. Security practitioners should monitor for firmware updates and restrict access to the affected endpoint.
Details
- CWE(s)