CVE-2025-11122
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda AC18 routers allows remote attackers to execute arbitrary code by sending specially crafted requests to the /goform/WizardHandle endpoint. This affects Tenda AC18 routers running firmware version 15.03.05.19. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attacker to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal network exposure remains.
🎯 Exploit Status
Public exploit code available in GitHub repositories; remote exploitation without authentication makes this highly accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router admin interface. 3. Reboot router after update.
🔧 Temporary Workarounds
Block WAN access to router admin interface
linuxPrevent external exploitation by restricting access to router management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable remote administration
allTurn off remote management feature in router settings
🧯 If You Can't Patch
- Isolate affected routers in separate network segment with strict firewall rules
- Implement network monitoring for suspicious traffic to/from router IP addresses
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface at 192.168.0.1 or 192.168.1.1Check Version:
curl -s http://router-ip/goform/GetSysInfo | grep firmwareVerify Fix Applied:
Verify firmware version is no longer 15.03.05.19 and test if /goform/WizardHandle endpoint responds to crafted requests📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/WizardHandle with abnormal parameter lengths
- Router reboot events following suspicious requests
Network Indicators:
- Unusual outbound connections from router IP
- Traffic patterns suggesting command and control communication
SIEM Query:
source="router.log" AND uri="/goform/WizardHandle" AND (bytes>1000 OR status=500)🔗 References
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle.md
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle2.md
- https://vuldb.com/?ctiid.326203
- https://vuldb.com/?id.326203
- https://vuldb.com/?submit.664194
- https://vuldb.com/?submit.664195
- https://www.tenda.com.cn/
