Tenda wxportalauth type Parameter Buffer Overflow Attempt (CVE-2025-9297)

Tim Peck@timpeck

•updated Nov 10, 2025•0•19

This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.