CVE-2025-14654
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC20 routers via a stack-based buffer overflow in the HTTP daemon. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running the vulnerable firmware version are at risk.
💻 Affected Systems
- Tenda AC20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Public exploit code exists in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AC20. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the vulnerable HTTP interface
Network Segmentation
allIsolate AC20 routers from critical network segments
🧯 If You Can't Patch
- Block inbound access to router web interface (port 80/443) at network perimeter
- Replace vulnerable devices with supported models from vendors with active security updates
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
curl -s http://router-ip/ | grep -i version or check web interfaceVerify Fix Applied:
Verify firmware version is newer than 16.03.08.12 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setPptpUserList
- Multiple failed buffer overflow attempts in HTTP logs
- Unexpected router configuration changes
Network Indicators:
- Exploit traffic patterns matching public PoCs
- Unusual outbound connections from router IP
- HTTP requests with oversized 'list' parameter
SIEM Query:
source="router_logs" AND (uri="/goform/setPptpUserList" OR method="POST" AND size>1000)