CVE-2025-11386
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC15 routers via a stack-based buffer overflow in the SetDDNSCfg function. Attackers can exploit this without authentication by sending specially crafted POST requests. All users running the affected firmware version are at risk.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if the device is behind a firewall with strict inbound filtering and not exposed to the internet.
🎯 Exploit Status
Public exploit code is available on GitHub, making this easily weaponizable. No authentication is required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AC15. 3. Log into router admin panel. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the router's web interface
Network Segmentation
allIsolate the router's management interface to a separate VLAN
🧯 If You Can't Patch
- Block access to port 80/443 on the router's WAN interface using firewall rules
- Implement network monitoring for unusual POST requests to /goform/SetDDNSCfg
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/goform/GetSysInfo | grep versionVerify Fix Applied:
Verify firmware version is no longer 15.03.05.18 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetDDNSCfg
- Router crash/reboot logs
- Large ddnsEn parameter values in web logs
Network Indicators:
- POST requests to router IP on port 80/443 with oversized ddnsEn parameter
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/goform/SetDDNSCfg" AND parameter="ddnsEn" AND length(value)>100