CVE-2025-14655
📋 TL;DR
A stack-based buffer overflow vulnerability in Tenda AC20 routers allows remote attackers to execute arbitrary code by manipulating the rebootTime parameter. This affects Tenda AC20 routers running firmware version 16.03.08.12. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Device takeover for botnet enrollment, credential theft, or network traffic interception.
If Mitigated
Denial of service or device reboot if exploit fails or protections block execution.
🎯 Exploit Status
Public exploit code exists, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
Check Tenda website for firmware updates. If available, download and install via router admin interface. Reboot router after update.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router admin interface
Network segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected devices with patched or different models
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 16.03.08.12, device is vulnerable.Check Version:
Check via router web interface at 192.168.0.1 or 192.168.1.1Verify Fix Applied:
Verify firmware version has changed from 16.03.08.12 after update.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetSysAutoRebbotCfg
- Multiple failed reboot attempts
- Unexpected device reboots
Network Indicators:
- Suspicious traffic to router management port (typically 80/443)
- Exploit pattern matching in network traffic
SIEM Query:
source_ip=* dest_ip=router_ip dest_port=80 uri_path="/goform/SetSysAutoRebbotCfg" method=POST