CVE-2025-5862 is a high severity (CVSS 8.8) buffer overflow in the Tenda AC7 router, firmware 15.03.06.44. The formSetPPTPUserList function handles the list argument unsafely, and the record says the exploit is public. No fixed firmware is listed, so check Tenda's support site and limit access to the admin interface.
What's affected
Tenda AC7 firmware 15.03.06.44, per the record. Other versions may be affected but the record does not say.
The record names the function formSetPPTPUserList in /goform/setPptpUserList, and the argument list.
No fixed firmware version is given in the record. Check the vendor's download page for a newer release.
How to check if you're exposed
Router firmware versions appear in the admin interface, usually under system status or firmware upgrade. Compare yours with 15.03.06.44.
You can also check from the network side whether the admin interface is reachable where it should not be.
nmap -p 80,8080 your-router-address
Run that only against devices you own, from inside your network and again from a guest or external network. If the admin page answers from outside your trusted LAN, fix that first.
What to do now
- Identify every Tenda device on your network and its firmware version.
- Check the Tenda support site for newer firmware for your exact model, and apply it if one exists.
- Turn off remote management, and make sure the admin page is reachable only from the trusted LAN.
- Use a strong admin password, since the CVSS vector shows a low privilege login is needed.
- If the device is no longer supported, plan its replacement.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The record describes a buffer overflow reached through the list argument. The function takes a value from the request and uses it without checking its length against the space set aside for it, so oversized input can overwrite adjacent memory. The CVSS vector shows network reach, a low privilege login and high impact on confidentiality, integrity and availability.
The record classifies the weakness as CWE-119 (Improper Restriction of Operations within Memory Bounds) and CWE-120 (Classic Buffer Overflow).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patched firmware?
The record lists none. Check the vendor's support site for your model and treat the device as exposed until you have a fix or have limited access.
Does an attacker need a login?
The CVSS vector lists low privileges required, so an authenticated session is needed. Keep admin credentials strong and the admin page off untrusted networks.
Sources
Last reviewed: 18 October 2026.
