CVE-2025-11324
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Tenda AC18 routers via the /goform/setNotUpgrade endpoint. Attackers can remotely execute arbitrary code by manipulating the newVersion parameter. This affects Tenda AC18 router users running vulnerable firmware.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to connected devices.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal network exposure remains.
🎯 Exploit Status
Public exploit code available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Navigate to System Tools > Firmware Upgrade 5. Upload and install new firmware 6. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin > System Tools > Remote Management > Disable
Network Segmentation
allIsolate router management interface from user networks
🧯 If You Can't Patch
- Replace affected router with supported model
- Implement strict firewall rules blocking access to router management interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System StatusCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 15.03.05.19(6318) after update📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/setNotUpgrade
- Unusual process execution in router logs
- Firmware version change attempts
Network Indicators:
- Exploit traffic patterns to router management port
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/setNotUpgrade" OR process="malicious_payload")