CVE-2025-15215: A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the…

PriorityP264high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.60%

45.0th percentile

A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
tenda	ac10u	—	—
tenda	ac10u	—	—
tenda	ac10u_firmware	—	—
tenda	ac10u_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/setPptpUserList↗

path/goform/setPptpUserList↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda AC10 setPptpUserList list Parameter Buffer Overflow Attempt (CVE-2025-45779, CVE-2025-65221, 2025-15215, 2025-15217)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"/goform/setPptpUserList"; fast_pattern; http.request_body; content:"list|3d|"; pcre:"/^[^\x26&]{200,}(?:\x26|$)/R"; reference:url,github.com/sunyou-iot/iot-vul/tree/main/TendaAC10/CVE-2025-45779; reference:cve,2025-45779; reference:cve,2025-5848; reference:cve,2025-65221; reference:cve,2025-15215; classtype:attempted-admin; sid:2062281; rev:2; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_05_12, cve CVE_2025_45779, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_13; target:dest_ip;)

bytes

list=<200+ bytes not containing & or \x26>

→Exploit is delivered via HTTP POST request to /goform/setPptpUserList; look for POST requests to this URI with an oversized `list` parameter (200+ characters without an ampersand delimiter) in the request body.
→The URI path is exactly 23 bytes (/goform/setPptpUserList), which can be used as a precise bsize match to reduce false positives.
→Attack targets networking equipment (Tenda AC10U) over plaintext HTTP; deploy detection at both perimeter and internal network boundaries.
→The vulnerable function is formSetPPTPUserList; the manipulated argument is `list`. Overflow is triggered remotely with no authentication implied by the public exploit disclosure.

·Affected firmware versions are specifically 15.03.06.48 and 15.03.06.49 for Tenda AC10U; detections should be scoped to devices running these versions where version fingerprinting is available. ↗
·The Snort/Suricata rule (sid:2062281) covers multiple related CVEs (CVE-2025-45779, CVE-2025-65221, CVE-2025-15215, CVE-2025-15217) with a shared signature; tune or split the rule if per-CVE attribution is required.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.