Tenda SetNetControlList list Parameter Buffer Overflow Attempt

Tim Peck@timpeck

•updated Nov 10, 2025•0•19

This rule detects attempts to exploit a buffer overflow vulnerability in the `SetNetControlList` function of Tenda routers. Specifically, it looks for HTTP POST requests to the `/goform/SetNetControlList` URI where the `list` parameter in the request body is excessively long (100 characters or more). This vulnerability (CVE-2025-9087, CVE-2025-29215, CVE-2025-1897) could lead to denial of service or arbitrary code execution.