CVE-2025-0349
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC6 routers allows remote attackers to execute arbitrary code by manipulating the src/mac parameter in the GetParentControlInfo function. This affects Tenda AC6 routers running firmware version 15.03.05.16. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Device crash/reboot causing service disruption, or limited code execution allowing configuration changes and network monitoring.
If Mitigated
Denial of service if exploit fails, or no impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub, making exploitation relatively straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for firmware updates beyond 15.03.05.16
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Log into Tenda router web interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware update. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segments only
🧯 If You Can't Patch
- Replace affected Tenda AC6 routers with patched or alternative devices
- Implement strict network access controls to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: System Status > Firmware Version. If version is 15.03.05.16, device is vulnerable.Check Version:
curl -s http://router-ip/goform/GetParentControlInfo | grep version or check web interfaceVerify Fix Applied:
After updating firmware, verify version is no longer 15.03.05.16 and test that GetParentControlInfo endpoint no longer accepts malformed src/mac parameters.📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to /goform/GetParentControlInfo
- Unusual POST requests with long src/mac parameters
- Router crash/reboot logs
Network Indicators:
- HTTP POST requests to /goform/GetParentControlInfo with unusually long parameters
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
source="router_logs" AND (uri_path="/goform/GetParentControlInfo" AND (param_length>100 OR status_code=500))