Introduction
Remote attackers can take control of Tenda AC18 routers running firmware 15.03.05.19(6318) by exploiting a stack-based buffer overflow in the PPPoE configuration interface. The vulnerability has a CVSS score of 8.8, and public exploit code is available. Any organization or individual using these devices should treat it as a high-priority risk.
Tenda is a major global supplier of networking equipment, especially for consumers and small businesses, and the AC18 is widely deployed in homes and small offices. The company's firmware has a history of vulnerabilities, buffer overflows in particular, and they have led to repeated security incidents affecting its products.
Technical Information
CVE-2025-11325 is a stack-based buffer overflow in Tenda AC18 firmware version 15.03.05.19(6318). The flaw is in the /goform/fast_setting_pppoe_set endpoint, which configures PPPoE connections through the router's web interface. When a remote attacker sends an HTTP POST request with an oversized Username parameter, the firmware copies the value into a stack-allocated buffer without proper bounds checking. This can overwrite stack data such as return addresses, which affects control flow and may allow arbitrary code execution with the privileges of the router's web server process.
No authentication is required if the endpoint is exposed to the network. Because public exploit code is available, a wide range of attackers can attempt exploitation.
No official patch or detection method has been published as of this writing.
Affected Systems and Versions
- Product: Tenda AC18
- Firmware: 15.03.05.19(6318)
- Only this firmware version is confirmed affected, based on available sources
- Vulnerable endpoint:
/goform/fast_setting_pppoe_set - Highest risk: devices with the admin interface exposed to untrusted networks
Vendor Security History
Tenda has a documented history of buffer overflow and memory corruption vulnerabilities in its router firmware, especially in the AC18 product line. Examples include:
- CVE-2022-38312: Stack overflow in another goform endpoint
- Multiple buffer overflows documented in CVE Details
Patch response times have been slow, and security advisories are infrequent. Similar vulnerabilities keep appearing across firmware versions, which suggests limited security maturity.
