cbcvebase.
CVE-2025-5848
published 2025-06-08

CVE-2025-5848: A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file…

PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.78%
51.5th percentile
A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

3 ranges
VendorProductVersion rangeFixed in
linuxlinux_kernel>= 6.17.0 < 6.17.36.17.3
tendaac15——
tendaac15_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/goform/setPptpUserList↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda AC10 setPptpUserList list Parameter Buffer Overflow Attempt (CVE-2025-45779, CVE-2025-65221, 2025-15215, 2025-15217)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"/goform/setPptpUserList"; fast_pattern; http.request_body; content:"list|3d|"; pcre:"/^[^\x26&]{200,}(?:\x26|$)/R"; reference:url,github.com/sunyou-iot/iot-vul/tree/main/TendaAC10/CVE-2025-45779; reference:cve,2025-45779; reference:cve,2025-5848; reference:cve,2025-65221; reference:cve,2025-15215; classtype:attempted-admin; sid:2062281; rev:2; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_05_12, cve CVE_2025_45779, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_13; target:dest_ip;)
bytes
list=<200+ bytes not containing & or \x26>
  • →Exploit targets HTTP POST requests to the exact URI /goform/setPptpUserList (URI length is exactly 23 bytes); match on POST method and this URI path. ↗
  • →The overflow is triggered via the `list` POST body parameter; look for `list=` (encoded as `list|3d|`) followed by 200 or more characters without an ampersand delimiter, indicating an oversized value.
  • →Traffic is plaintext (no TLS); deploy detection at both perimeter and internal network boundaries.
  • →The vulnerability is in function formSetPPTPUserList within the file /goform/setPptpUserList of the HTTP POST Request Handler; the manipulated argument is `list`. ↗
  • ·The Snort/Suricata rule (sid:2062281) was originally written for Tenda AC10 and references CVE-2025-45779 as its primary CVE, but explicitly cross-references CVE-2025-5848 (Tenda AC15). Validate applicability against your specific device model before deploying.
  • ·The 200-character threshold in the PCRE (`{200,}`) is a heuristic; legitimate PPTP user list payloads should be reviewed to tune the threshold and avoid false positives.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.