CVE-2025-15218: A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file…

PriorityP271high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

2.86%

85.2th percentile

A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing a manipulation of the argument lanMask can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
tenda	ac10u	—	—
tenda	ac10u	—	—
tenda	ac10u_firmware	—	—
tenda	ac10u_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/goform/AdvSetLanip↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda AdvSetLanip lanMask Parameter Buffer Overflow Attempt (CVE-2025-5861, CVE-2025-15218)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:19; content:"/goform/AdvSetLanip"; fast_pattern; http.request_body; content:"lanMask"; pcre:"/^[^\x2c\x7d$]{100,}(?:\x2c|\x7d|$)/R"; reference:url,candle-throne-f75.notion.site/Tenda-AC15-fromadvsetlanip-20adf0aa118580a09182c1c5c42079fc; reference:cve,2025-5861; reference:cve,2025-15218; classtype:web-application-attack; sid:2062819; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_06_09, cve CVE_2025_5861, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Detect POST requests to /goform/AdvSetLanip with a lanMask parameter value exceeding 100 characters (no comma or closing brace delimiter), indicative of a buffer overflow attempt. ↗
→The URI path /goform/AdvSetLanip has a fixed byte size of 19; use bsize matching to reduce false positives. ↗
→Attack is plaintext HTTP (not TLS), targeting networking equipment at the perimeter; deploy detection at perimeter/ingress points. ↗
→The vulnerability is in the fromadvsetlanip function handling the lanMask POST parameter; focus monitoring on that specific argument for oversized input. ↗

·The Snort/Suricata rule (sid:2062819) covers both CVE-2025-5861 and CVE-2025-15218 together; ensure your ruleset distinguishes affected firmware versions (15.03.06.48 / 15.03.06.49 for AC10U) if device-specific tuning is needed. ↗
·Public exploit code is available; treat any matching traffic as high-severity and prioritize immediate triage. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.