CVE-2025-7544

CVE-2025-7544 is a critical stack-based buffer overflow vulnerability affecting the Tenda AC1206 router (firmware version 15.03.06.23). This flaw resides in the formSetMacFilterCfg function within the /goform/setMacFilterCfg file, specifically when processing the 'deviceList' argument. With a CVSS score of 8.8 (High), this vulnerability can be exploited remotely with low privileges and no user interaction, leading to high impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed, and there are reports of active exploitation, including its use by the Zerobot malware against Tenda AC1206 routers. While no Metasploit or ExploitDB modules are currently available, the public disclosure and active exploitation indicate a significant threat. The vulnerability has garnered community discussion, with one mention noting its active exploitation.