Tenda QuickIndex PPPOEPassword Parameter Buffer Overflow Attempt (CVE-2025-9298)

Tim Peck@timpeck

•updated Nov 10, 2025•0•18

This rule detects an attempted buffer overflow vulnerability (CVE-2025-9298) in Tenda routers. Specifically, it looks for HTTP POST requests to the '/goform/QuickIndex' URI where the 'PPPOEPassword' parameter contains an excessively long string (100 or more characters) that could lead to a buffer overflow.