CVE-2025-29386
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC9 routers by exploiting a stack overflow in the web interface. Attackers can take full control of affected devices without authentication. All users running the vulnerable firmware version are affected.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, intercept network traffic, pivot to internal networks, or join botnets.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, or use in DDoS attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though LAN-side attacks remain possible.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC9
3. Log into router admin interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Restrict LAN access
allUse firewall rules to limit which devices can access router admin interface
🧯 If You Can't Patch
- Replace router with different model/brand
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status. If version is V15.03.05.14_multi, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from vulnerable version after update.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/AdvSetMacMtuWan with long mac parameter
- Unusual process execution or memory errors in system logs
Network Indicators:
- HTTP requests with unusually long parameters to router IP
- Traffic patterns suggesting command and control communication
SIEM Query:
source="router.log" AND (uri="/goform/AdvSetMacMtuWan" AND content_length>100) OR (process="exploit" OR memory="overflow")