CVE-2025-11526
📋 TL;DR
This vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the WifiMacFilterSet function. It affects users of Tenda AC7 firmware version 15.03.06.44, potentially leading to full device compromise. The exploit is publicly available, increasing the risk of widespread attacks.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router takeover, enabling data interception, network disruption, or use as a botnet node.
Likely Case
Router compromise allowing attackers to modify settings, steal credentials, or launch further attacks on connected devices.
If Mitigated
Limited impact if isolated from the internet or patched, with potential for denial-of-service if exploitation fails.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making it accessible to attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Tenda's official website or support channels for firmware updates; if unavailable, consider workarounds or replacement.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's web interface to block remote exploitation.
Access router settings via web interface, navigate to remote management section, and disable it.
Restrict network access
allUse firewall rules to limit inbound traffic to the router's administrative interface.
Configure firewall to block external access to port 80/443 on the router's IP.
🧯 If You Can't Patch
- Replace the router with a model that receives security updates.
- Isolate the router in a segmented network to limit potential damage from compromise.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in the router's web interface under System Status or similar section.Check Version:
Log into the router's web interface and navigate to the firmware information page; no CLI command is typically available.Verify Fix Applied:
Update to a newer firmware version if available and confirm the version has changed from 15.03.06.44.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiMacFilterSet with manipulated wifi_chkHz parameter.
Network Indicators:
- Suspicious traffic patterns to the router's administrative port from external IPs.
SIEM Query:
source_ip:external AND destination_port:80 AND uri_path:"/goform/WifiMacFilterSet"🔗 References
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/WifiMacFilterSet.md
- https://vuldb.com/?ctiid.327664
- https://vuldb.com/?id.327664
- https://vuldb.com/?submit.669854
- https://vuldb.com/?submit.669861
- https://www.tenda.com.cn/
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/WifiMacFilterSet.md
