CVE-2022-25461
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC6 routers via a stack overflow in the SetPptpServerCfg function. Attackers can exploit this by sending specially crafted requests to the startip parameter. Users running Tenda AC6 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, credential theft, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. The vulnerability requires no authentication and has a straightforward exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware version
Vendor Advisory: Not publicly documented by vendor
Restart Required: Yes
Instructions:
1. Visit Tenda official website. 2. Download latest firmware for AC6 model. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable PPTP Server
allDisable the vulnerable PPTP server functionality if not required
Restrict WAN Access
allConfigure firewall to block external access to router management interface
🧯 If You Can't Patch
- Isolate vulnerable routers in separate VLAN with strict access controls
- Implement network monitoring for suspicious traffic to/from router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
Login to router web interface and check System Status pageVerify Fix Applied:
Verify firmware version is newer than v15.03.05.09_multi and test PPTP functionality📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to SetPptpServerCfg endpoint
- Multiple failed authentication attempts followed by successful exploit
Network Indicators:
- Unexpected traffic from router to external IPs
- PPTP connection attempts from unusual sources
SIEM Query:
source_ip=router_ip AND (uri_path="*SetPptpServerCfg*" OR method=POST AND uri_contains="pptp")