CVE-2025-15356
📋 TL;DR
A buffer overflow vulnerability in Tenda AC20 routers allows remote attackers to execute arbitrary code by sending specially crafted requests to the PowerSaveSet function. This affects all Tenda AC20 routers running firmware version 16.03.08.12 or earlier. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda AC20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement to other network devices.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and botnet recruitment.
If Mitigated
Limited impact if device is behind firewall with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit code is available on GitHub. Exploitation requires sending a crafted HTTP POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via web interface. 3. If no update available, consider replacing device or implementing workarounds.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router web interface -> Advanced Settings -> Remote Management -> Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected Tenda AC20 router with a different model or vendor
- Place router behind a firewall that blocks all inbound traffic to port 80/443
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login -> System Status -> Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 16.03.08.12📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/PowerSaveSet
- Multiple failed login attempts followed by PowerSaveSet requests
Network Indicators:
- HTTP POST requests to /goform/PowerSaveSet with unusual parameter lengths
- Traffic from unexpected sources to router management port
SIEM Query:
source="router_logs" AND (uri="/goform/PowerSaveSet" OR (method="POST" AND uri CONTAINS "PowerSaveSet"))🔗 References
- https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC20_Buffer_Overflow/Tenda%20AC20_Buffer_Overflow.md#poc
- https://github.com/xyh4ck/iot_poc/tree/main/Tenda%20AC20_Buffer_Overflow
- https://vuldb.com/?ctiid.338742
- https://vuldb.com/?id.338742
- https://vuldb.com/?submit.726360
- https://www.tenda.com.cn/
