CVE-2025-29121
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Tenda AC6 routers version V15.03.05.16. Attackers can exploit this by sending specially crafted requests to the /goform/fast_setting_wifi_set endpoint, potentially allowing remote code execution. This affects users with vulnerable Tenda AC6 routers exposed to untrusted networks.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges, allowing complete device compromise, persistence, and lateral movement into connected networks.
Likely Case
Router crash leading to denial of service, or limited code execution to modify router settings and intercept network traffic.
If Mitigated
Denial of service from router crash if exploit fails, with no persistent compromise.
🎯 Exploit Status
Exploitation requires crafting specific HTTP POST requests with malicious timeZone parameter values. No authentication is needed, but attackers must understand buffer overflow techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda for updated firmware version
Vendor Advisory: Not publicly available at time of analysis
Restart Required: Yes
Instructions:
1. Log into Tenda router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Log into router admin > Advanced > System Tools > Remote Management > Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to port 80/443 on router
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status. If version is V15.03.05.16, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
After firmware update, verify version has changed from V15.03.05.16 in System Status page.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/fast_setting_wifi_set with long timeZone parameters
- Router crash/reboot logs
Network Indicators:
- HTTP requests with abnormally long timeZone parameter values (over 100 characters)
- Traffic to router port 80/443 from unexpected sources
SIEM Query:
source="router_logs" AND (url="/goform/fast_setting_wifi_set" AND param_length(timeZone)>100)