CVE-2025-24322
📋 TL;DR
An unsafe default authentication vulnerability in Tenda AC6 routers allows attackers to execute arbitrary code via specially crafted network requests during initial setup. This affects Tenda AC6 V5.0 routers running vulnerable firmware versions. Attackers can trigger this by browsing to the device.
💻 Affected Systems
- Tenda AC6 V5.0
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Router takeover allowing DNS hijacking, credential theft, and use as pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall and initial setup was completed securely.
🎯 Exploit Status
Exploitation requires browsing to device during initial setup phase; detailed technical analysis available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware
Vendor Advisory: https://www.tenda.com.cn/en/security
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Reboot router.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent external access to router management interface
Navigate to Advanced > System Tools > Remote Management and disable
Change Default Credentials
allUse strong unique credentials after initial setup
Navigate to System Tools > Password and set strong password
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Monitor for suspicious traffic to/from router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System StatusCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Confirm firmware version is newer than V02.03.01.110📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts during setup
- Multiple failed login attempts from single source
Network Indicators:
- HTTP requests to /goform/setAuth during initial setup
- Unusual outbound connections from router
SIEM Query:
source="router.log" AND ("setup" OR "auth" OR "goform") AND status=200