CVE-2025-29384
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC9 routers by exploiting a stack overflow in the wanMTU parameter. Attackers can take full control of affected devices without authentication. All users running the vulnerable firmware version are affected.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, intercept network traffic, pivot to internal networks, or join botnets.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, or denial of service attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda support website for firmware updates
2. If update available, download and flash via web interface
3. Factory reset after update to clear any potential compromise
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router settings > Disable 'Remote Management' or 'Web Management from WAN'
Network segmentation
allIsolate router management interface from user networks
Configure VLANs to separate management traffic
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Implement strict firewall rules blocking all inbound traffic to router management interface (typically ports 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer V15.03.05.14_multi📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/AdvSetMacMtuWan
- Large payloads in wanMTU parameter
- Router reboot events
Network Indicators:
- Unusual outbound connections from router
- DNS changes not initiated by admin
- Unexpected open ports on router
SIEM Query:
source="router_logs" AND (uri="/goform/AdvSetMacMtuWan" OR parameter="wanMTU")