CVE-2025-25634
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Tenda AC15 routers version 15.03.05.19. Attackers can exploit this by sending specially crafted requests to the GetParentControlInfo endpoint, potentially allowing remote code execution. This affects users running vulnerable firmware on Tenda AC15 routers.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router crash/reboot causing denial of service, or limited code execution within router constraints.
If Mitigated
Denial of service only if exploit fails or controls limit impact.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation appears straightforward with published details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC15. 3. Access router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin > System Tools > Remote Management > Disable
Block Access to Vulnerable Endpoint
allUse firewall rules to block access to /goform/GetParentControlInfo
🧯 If You Can't Patch
- Isolate router on separate network segment with strict firewall rules
- Implement network monitoring for exploitation attempts targeting the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status. If version is 15.03.05.19, device is vulnerable.Check Version:
Check via web interface or use: curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from 15.03.05.19 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/GetParentControlInfo
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- HTTP POST requests to /goform/GetParentControlInfo with long src parameters
- Unusual outbound connections from router
SIEM Query:
http.url:"/goform/GetParentControlInfo" AND http.method:POST AND http.request_body_length:>1000