CVE-2025-11523
📋 TL;DR
This vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary commands through command injection in the lanIp parameter of the AdvSetLanip endpoint. Attackers can potentially take full control of affected routers. Users with Tenda AC7 routers running vulnerable firmware are affected.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router allowing attacker to intercept traffic, modify DNS settings, install malware, pivot to internal network, or brick the device.
Likely Case
Router compromise leading to DNS hijacking, credential theft from network traffic, or installation of persistent backdoors.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware > 15.03.06.44
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Visit Tenda support website. 2. Download latest firmware for AC7 model. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent remote access to router management interface from internet
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace router with different model/brand
- Place router behind firewall with strict inbound rules blocking access to port 80/443
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System Tools. If version is 15.03.06.44, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
After firmware update, verify version number has changed from 15.03.06.44 to newer version.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/AdvSetLanip with unusual lanIp parameters containing shell metacharacters
- Unusual command execution in router logs
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- DNS queries to suspicious domains from router
SIEM Query:
source="router_logs" AND (url="/goform/AdvSetLanip" AND (lanIp="*;*" OR lanIp="*|*" OR lanIp="*`*"))