CVE Alert: CVE-2025-11527 – Tenda – AC7

Risk verdict

High risk of remote code execution on Tenda AC7 due to a stack-based overflow in fast_setting_pppoe_set; exploit is publicly disclosed, making weaponisation likely. KEV/EPSS indicators are not provided in the data.

Why this matters

A successful exploit could give an attacker full control of the device, including firmware modification and network access. In consumer and SMB deployments, exposed management interfaces often sit at the network edge, enabling lateral movement into connected devices or interception of traffic.

Most likely attack path

Remote attacker, with network access, can send crafted input to /goform/fast_setting_pppoe_set, abusing an unauthorised Password argument to trigger a buffer overflow. The CVSS metrics imply no user interaction, low access complexity but requiring local privileges to modify the password field, and high impact across confidentiality, integrity and availability. With PoC public, reconciliation to arbitrary code execution and persistence is plausible, enabling rapid device compromise and potential network pivot.

Who is most exposed

Typical exposure applies to consumer/ISP-supplied routers and small office devices that expose management endpoints over the internet or poorly protected WAN interfaces. Environments using default or weak credentials plus remote management enabled are especially at risk.

Detection ideas

• Crashes or restarts of the management process on Tenda AC7.
• Logs showing anomalous/large Password payloads targeting /goform/fast_setting_pppoe_set.
• Unusual CPU/memory spikes or stack traces in device diagnostics.
• External probes targeting management endpoints, especially from unauthorised sources.
• Unexpected firmware dumps or process anomalies after handling specific requests.

Mitigation and prioritisation

• Apply the latest firmware from the vendor with the fix; verify update succeeds.
• Disable remote management or restrict access to trusted networks; enforce strong access controls.
• Place affected devices behind network segmentation; limit exposure to the internet.
• Monitor management interfaces for anomalous payloads and block suspicious IPs; enable IDS/IPS rules if available.
• Schedule and test patches during maintenance windows; document changes and rollback plan.