CVE-2025-3161
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC10 routers allows remote attackers to execute arbitrary code by manipulating the 'list' parameter in the ShutdownSetAdd function. This affects Tenda AC10 routers running firmware version 16.03.10.13. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to intercept network traffic, modify device settings, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind strict firewall rules, not internet-facing, and network segmentation prevents lateral movement.
🎯 Exploit Status
Public exploit code is available in GitHub repositories. The vulnerability requires sending specially crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: Yes
Instructions:
1. Check Tenda official website for firmware updates. 2. Download latest firmware for AC10 model. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the vulnerable web interface by disabling remote management features.
Network Segmentation
allIsolate Tenda AC10 routers in separate VLANs with strict firewall rules limiting access to management interface.
🧯 If You Can't Patch
- Replace affected Tenda AC10 routers with different models or brands that are not vulnerable.
- Implement strict network access controls to limit which devices can communicate with the router's management interface.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System Tools > Firmware Upgrade page.Check Version:
No CLI command available. Must check via web interface at http://router_ip/ or using router's admin interface.Verify Fix Applied:
Verify firmware version has been updated to a version later than 16.03.10.13 (once available).📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/ShutdownSetAdd with long 'list' parameters
- Multiple failed authentication attempts followed by exploitation attempts
Network Indicators:
- HTTP traffic to router IP on port 80/443 with POST requests containing buffer overflow patterns in parameters
SIEM Query:
source="router_logs" AND (url="/goform/ShutdownSetAdd" OR (method="POST" AND uri CONTAINS "ShutdownSetAdd"))🔗 References
- https://github.com/LxxxtSec/CVE/blob/main/CVE_1.md
- https://github.com/LxxxtSec/CVE/blob/main/CVE_1.md#vulnerability-proof-supplement-remote-code-execution-rce
- https://pan.baidu.com/s/1_zhGlS0fFhz0Pkh8svljjA?pwd=viwq
- https://vuldb.com/?ctiid.303107
- https://vuldb.com/?id.303107
- https://vuldb.com/?submit.542437
- https://www.tenda.com.cn/
