CVE Alert: CVE-2025-12611 – Tenda – AC21

**Risk verdict** High risk: network-exposed buffer overflow with remote code execution potential; publicly available exploit increases urgency.

**Why this matters** The vulnerability grants high-impact access to confidentiality, integrity and availability with no user interaction required, and a PoC is publicly available. Compromise of a gateway device could enable VPN abuse, traffic interception, or pivot into internal networks, affecting both home and small business environments.

**Most likely attack path** An unauthenticated or minimally authenticated attacker can target the PPTP server configuration endpoint over the network, sending crafted data (startIp) to trigger memory corruption. The low-privilege requirement and network reachability mean exploitation could be attempted remotely, potentially yielding full device compromise and subsequent lateral movement within the local network.

**Who is most exposed** Commonly deployed consumer and small-office routers with PPTP server features are at risk, especially when management interfaces or VPN endpoints are reachable from the internet or poorly protected on LAN segments.

Detection ideas

• Look for unusual or malformed requests to the PPTP server config endpoint, especially with abnormal startIp payloads.
• Monitor for device crashes, reboot events, or memory corruption logs tied to the affected path.
• IDS/IPS signatures or behavioural alerts for attempts to trigger the /goform/SetPptpServerCfg endpoint.
• Unusual spikes in VPN connection attempts or VPN service restarts.

Mitigation and prioritisation

• Apply vendor-provided firmware patch or upgrade to a non-affected release as a top priority.
• If patching is delayed, disable the PPTP server feature or restrict access to trusted networks only; apply strict ACLs to management interfaces.
• Segregate VPN endpoints from untrusted networks; replace PPTP with modern TLS/IPsec-based VPN where feasible.
• Initiate a change-management window for firmware upgrades; test in a controlled environment before broad rollout.
• Ensure monitoring and logging of VPN-related configuration changes post-patch.