CVE-2025-44872
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda AC9 routers that allows attackers to execute arbitrary commands via the deviceName parameter in the formsetUsbUnload function. Attackers can exploit this to gain full control of affected routers. Users running Tenda AC9 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda AC9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing persistent backdoor installation, network traffic interception, lateral movement to connected devices, and botnet recruitment.
Likely Case
Router takeover enabling DNS hijacking, credential theft from network traffic, and deployment of malware to connected devices.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router management interface.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repositories, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC9. 3. Access router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Implement strict firewall rules blocking all external access to router management ports (typically 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or similar sectionCheck Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version is updated to a version later than V15.03.06.42_multi📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to formsetUsbUnload endpoint
- Suspicious command execution in system logs
- Unexpected process creation
Network Indicators:
- Unusual traffic to router management ports from external IPs
- Suspicious payloads in HTTP requests to router
SIEM Query:
source="router_logs" AND (uri="/goform/setUsbUnload" OR process="sh" OR process="bash") AND command="*"