CVE-2025-0566
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code by manipulating the 'mac' parameter in the formSetDevNetName function. This affects Tenda AC15 routers running firmware version 15.13.07.13. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Device takeover for credential theft, DNS hijacking, man-in-the-middle attacks, or denial of service against the router.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details have been publicly disclosed, making exploitation relatively straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware > 15.13.07.13
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Visit Tenda support website. 2. Download latest firmware for AC15. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate AC15 routers in separate network segments with strict firewall rules
Access Control
allBlock external access to router admin interface (port 80/443) at network perimeter
🧯 If You Can't Patch
- Replace vulnerable devices with patched or alternative models
- Implement strict network segmentation and firewall rules to limit router exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version is newer than 15.13.07.13 after patching📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetDevNetName with long mac parameters
- Multiple failed login attempts followed by exploitation attempts
- Unexpected router reboots or configuration changes
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- DNS queries to suspicious domains from router
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (uri="/goform/SetDevNetName" AND (param="mac" AND length>20) OR event="buffer_overflow")