CVE-2025-10838
📋 TL;DR
A buffer overflow vulnerability in Tenda AC21 routers allows remote attackers to execute arbitrary code by manipulating the wpapsk_crypto parameter. This affects Tenda AC21 routers running firmware version 16.03.08.16. Attackers can exploit this without authentication to potentially take control of affected devices.
💻 Affected Systems
- Tenda AC21
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and denial of service.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router admin interfaces.
🎯 Exploit Status
Public proof-of-concept code exists demonstrating remote exploitation without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable WAN access to admin interface
allPrevent external access to router administration by disabling remote management
Access router admin → System Tools → Remote Management → Disable
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected router with different model
- Implement strict firewall rules blocking all external access to router admin interface (ports 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status → Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 16.03.08.16 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiExtraSet
- Multiple failed buffer overflow attempts
- Unexpected router reboots
Network Indicators:
- Unusual traffic patterns from router
- External IPs accessing router admin interface
- Malformed HTTP requests to router
SIEM Query:
source="router_logs" AND (uri="/goform/WifiExtraSet" OR message="buffer overflow")🔗 References
- https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md
- https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md#poc
- https://vuldb.com/?ctiid.325200
- https://vuldb.com/?id.325200
- https://vuldb.com/?submit.657126
- https://www.tenda.com.cn/
