CVE-2025-11326
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in Tenda AC18 routers through manipulation of the wifi_chkHz parameter in the WifiMacFilterSet endpoint. Attackers can exploit this remotely to execute arbitrary code on affected devices. Users of Tenda AC18 routers with firmware version 15.03.05.19(6318) are affected.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, and lateral movement into internal networks.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, credential theft, and denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists on GitHub. Attack requires sending crafted HTTP POST request to /goform/WifiMacFilterSet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Upload via router web interface. 4. Reboot router.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent remote exploitation by disabling router management from WAN/Internet
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected routers with patched or alternative models
- Implement strict firewall rules blocking all inbound traffic to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1Check Version:
curl -s http://router-ip/goform/GetSysInfo | grep firmwareVerify Fix Applied:
Verify firmware version is newer than 15.03.05.19(6318)📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/WifiMacFilterSet with abnormal wifi_chkHz parameter
Network Indicators:
- Unusual traffic patterns to router management interface from external IPs
SIEM Query:
source="router_logs" AND uri="/goform/WifiMacFilterSet" AND method="POST"