CVE-2025-14992
📋 TL;DR
This CVE describes a stack-based buffer overflow vulnerability in Tenda AC18 routers running firmware version 15.03.05.05. Attackers can remotely exploit this vulnerability by sending specially crafted HTTP requests to the GetParentControlInfo endpoint, potentially allowing arbitrary code execution. This affects all users with vulnerable Tenda AC18 routers exposed to network access.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain full control of the router, enabling them to intercept traffic, deploy malware, pivot to internal networks, or create persistent backdoors.
Likely Case
Attackers achieve remote code execution to compromise the router, potentially using it for botnet participation, DNS hijacking, or credential theft.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
Public proof-of-concept demonstrates exploitation via HTTP request manipulation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel → System Tools → Remote Management → Disable
Restrict Management Interface Access
allLimit access to router management interface to trusted IPs only
Access router admin panel → Security → Firewall → Add IP restriction rules
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Replace vulnerable router with patched or alternative model
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface or SSH: cat /proc/versionCheck Version:
cat /proc/version or check web interface System Status pageVerify Fix Applied:
Verify firmware version is updated beyond 15.03.05.05📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/GetParentControlInfo
- Multiple failed buffer overflow attempts in system logs
Network Indicators:
- HTTP requests with malformed 'mac' parameter to router management interface
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/goform/GetParentControlInfo" AND (mac="*" OR length(mac)>20)🔗 References
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_AC18/GetParentControlInfo/GetParentControlInfo.md
- https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_AC18/GetParentControlInfo/GetParentControlInfo.md#reproduce
- https://vuldb.com/?ctiid.337686
- https://vuldb.com/?id.337686
- https://vuldb.com/?submit.719073
- https://www.tenda.com.cn/
