CVE-2025-11586
📋 TL;DR
This vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the setNotUpgrade function. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running vulnerable firmware versions are at risk.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify device settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code is available and exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware
3. Upload via router admin interface
4. Reboot router
🔧 Temporary Workarounds
Block External Access
linuxPrevent external exploitation by blocking inbound access to router admin interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote administration features in router settings
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN
- Implement strict firewall rules blocking all inbound traffic to router admin ports
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface at System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 15.03.06.44📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setNotUpgrade
- Multiple failed upgrade attempts
- Unexpected device reboots
Network Indicators:
- HTTP POST requests to /goform/setNotUpgrade with long newVersion parameter
- Unusual outbound connections from router
SIEM Query:
source="router-logs" AND uri="/goform/setNotUpgrade" AND method="POST"