CVE-2025-10442
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary operating system commands on Tenda AC9 and AC15 routers through command injection in the formexeCommand function. Attackers can exploit this without authentication to gain full control of affected devices. Users running vulnerable firmware versions are at risk.
💻 Affected Systems
- Tenda AC9
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, credential theft, network traffic interception, and lateral movement to internal devices.
Likely Case
Router takeover leading to DNS hijacking, credential harvesting, and botnet recruitment.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router admin interface.
🎯 Exploit Status
Public proof-of-concept available. Exploitation requires sending crafted HTTP POST requests to /goform/exeCommand endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda for latest firmware > 15.03.05.14
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware upgrade section. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Reboot router.
🔧 Temporary Workarounds
Disable WAN access to admin interface
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to dedicated VLAN
🧯 If You Can't Patch
- Replace affected routers with patched or alternative models
- Implement strict firewall rules blocking all external access to router IP on ports 80/443
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or About pageCheck Version:
Login to router web interface and navigate to system information pageVerify Fix Applied:
Verify firmware version is greater than 15.03.05.14 and test endpoint with safe payload📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/exeCommand with unusual parameters
- System logs showing unexpected command execution
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control
SIEM Query:
http.url:"/goform/exeCommand" AND http.method:POST AND (cmdinput:* OR *cmdinput*)