CVE-2025-0528
📋 TL;DR
This critical vulnerability in Tenda AC8, AC10, and AC18 routers allows remote attackers to execute arbitrary commands via command injection in the HTTP request handler for the /goform/telnet endpoint. Attackers can gain full control of affected devices without authentication. Organizations and home users using these specific router models are affected.
💻 Affected Systems
- Tenda AC8
- Tenda AC10
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other devices, and persistent backdoor installation.
Likely Case
Router compromise allowing attackers to intercept network traffic, modify DNS settings, deploy malware to connected devices, and use the device for botnet activities.
If Mitigated
Limited impact with proper network segmentation and monitoring, though device functionality may still be disrupted.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Visit Tenda support website. 2. Download latest firmware for your model. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router admin interface
Network segmentation
allIsolate vulnerable routers from critical network segments
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Implement strict network access controls to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
Login to router admin interface and check System Status pageVerify Fix Applied:
Confirm firmware version is updated beyond 16.03.10.20 and test that /goform/telnet endpoint no longer accepts malicious input📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/telnet
- Telnet service activation logs
- Unusual command execution in system logs
Network Indicators:
- Unexpected outbound connections from router
- Telnet traffic from router to unknown destinations
- HTTP requests with command injection patterns to router
SIEM Query:
source="router_logs" AND (uri="/goform/telnet" OR cmd="telnet") AND (method="POST" OR status="200")