CVE-2025-11528
📋 TL;DR
This vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the saveAutoQos function. Attackers can exploit this without authentication to potentially take full control of affected devices. Users of Tenda AC7 routers with firmware version 15.03.06.44 are affected.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent remote access, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution leading to device takeover, creation of botnet nodes, or deployment of malware.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists on GitHub. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router admin panel -> Advanced Settings -> Remote Management -> Disable
Network segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to port 80/443 on router IP
🧯 If You Can't Patch
- Replace affected devices with patched or different vendor equipment
- Implement strict network access controls to limit exposure of router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 15.03.06.44 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/saveAutoQos
- Multiple failed buffer overflow attempts
- Unexpected device reboots
Network Indicators:
- HTTP requests with long enable parameter values to router IP
- Traffic spikes to router management port
SIEM Query:
source="router.log" AND (uri="/goform/saveAutoQos" OR "enable=" AND length>100)